embedded patch to cure 8 apples

Signed-off-by: SergeySlice <sergey.slice@gmail.com>
This commit is contained in:
SergeySlice 2020-05-27 21:04:31 +03:00
parent 59c3764c27
commit d36f1ae23a
8 changed files with 149 additions and 43 deletions

View File

@ -476,6 +476,8 @@
<false/>
<key>AppleRTC</key>
<false/>
<key>EightApple</key>
<true/>
<key>#KextsToPatch</key>
<array>
<dict>

View File

@ -720,6 +720,7 @@ CopyKernelAndKextPatches (IN OUT KERNEL_AND_KEXT_PATCHES *Dst,
Dst->KPKernelPm = Src->KPKernelPm;
Dst->KPAppleIntelCPUPM = Src->KPAppleIntelCPUPM;
Dst->KPAppleRTC = Src->KPAppleRTC;
Dst->EightApple = Src->EightApple;
Dst->KPDELLSMBIOS = Src->KPDELLSMBIOS;
Dst->FakeCPUID = Src->FakeCPUID;
Dst->KPPanicNoKextDump = Src->KPPanicNoKextDump;
@ -960,6 +961,11 @@ FillinKextPatches (IN OUT KERNEL_AND_KEXT_PATCHES *Patches,
Patches->KPAppleRTC = !IsPropertyFalse(Prop); //default = TRUE
}
Prop = GetProperty(DictPointer, "EightApple");
if (Prop != NULL || gBootChanged) {
Patches->EightApple = IsPropertyTrue(Prop);
}
//
// Dell SMBIOS Patch
//
@ -1027,12 +1033,12 @@ FillinKextPatches (IN OUT KERNEL_AND_KEXT_PATCHES *Patches,
}
Patches->ForceKexts = newForceKexts;
DBG("ForceKextsToLoad: %lld requested\n", Count);
DBG("ForceKextsToLoad: %lld requested\n", Count);
for (i = 0; i < Count; i++) {
EFI_STATUS Status = GetElement(Prop, i, &Prop2);
if (EFI_ERROR(Status)) {
DBG(" - [%02lld]: ForceKexts error %s getting next element\n", i, strerror(Status));
DBG(" - [%02lld]: ForceKexts error %s getting next element\n", i, strerror(Status));
continue;
}

View File

@ -123,26 +123,46 @@ UINTN LOADER_ENTRY::searchProcInDriver(UINT8 * driver, UINT32 driverLen, const c
}
}
if (!found) {
DBG_RT("%s not found\n", procedure);
// DBG_RT("%s not found\n", procedure);
return 0;
}
INT32 lSegVAddr;
// DBG_RT("found section 0x%x at pos=%d\n", vArray[i].Seg, i);
INTN lSegVAddr;
switch (vArray[i].Seg) {
case ID_SEG_DATA:
lSegVAddr = FindBin(driver, 0x1600, (const UINT8 *)kDataSegment, (UINT32)strlen(kDataSegment));
break;
case ID_SEG_DATA_CONST:
lSegVAddr = FindBin(driver, 0x1600, (const UINT8 *)kDataConstSegment, (UINT32)strlen(kDataConstSegment));
case ID_SEС_CONST:
lSegVAddr = FindSection(driver, 0x1600, (const UINT8 *)kDataSegment, (const UINT8 *)kConstSection);
break;
case ID_SEG_TEXT_CONST:
lSegVAddr = FindSection(driver, 0x1600, (const UINT8 *)kTextSegment, (const UINT8 *)kConstSection);
break;
case ID_SEG_DATA_COMMON:
lSegVAddr = FindSection(driver, 0x1600, (const UINT8 *)kDataSegment, (const UINT8 *)kCommonSection);
break;
case ID_SEG_DATA_DATA2:
case ID_SEG_DATA_DATA:
lSegVAddr = FindSection(driver, 0x1600, (const UINT8 *)kDataSegment, (const UINT8 *)kDataSection);
break;
case ID_SEG_KLD:
case ID_SEG_KLD2:
lSegVAddr = FindBin(driver, 0x2000, (const UINT8 *)kKldSegment, (UINT32)strlen(kKldSegment));
break;
// case ID_SEC_BSS:
// lSegVAddr = FindSection(driver, 0x1600, (const UINT8 *)kDataSegment, (const UINT8 *)kBssSection);
// break;
case ID_SEC_BSS: //it works this way
case ID_SEG_TEXT:
default:
lSegVAddr = FindBin(driver, 0x600, (const UINT8 *)kTextSegment, (UINT32)strlen(kTextSegment));
lSegVAddr = FindSection(driver, 0x600, (const UINT8 *)kTextSegment, (const UINT8 *)kPrelinkTextSection);
break;
// lSegVAddr = FindBin(driver, 0x600, (const UINT8 *)kTextSegment, (UINT32)strlen(kTextSegment));
// break;
default:
return vArray[i].ProcAddr;
}
if (lSegVAddr == 0) {
lSegVAddr = 0x38;
@ -173,7 +193,7 @@ UINTN LOADER_ENTRY::searchProc(const char *procedure)
// DBG_RT("Offset %lx Seg=%x\n", Offset, vArray[i].Seg);
// DBG_RT("Name to compare %s\n", &Names[Offset]);
// Stall(3000000);
if (AsciiStrStr(&Names[Offset], procedure) != NULL) { //if (CompareMem(&Names[Offset], procedure, nameLen) == 0) {
if (AsciiStrStr(&Names[Offset], procedure) != NULL) {
found = true;
break;
}
@ -2293,6 +2313,7 @@ LOADER_ENTRY::KernelAndKextsPatcherStart()
KextPatchesNeeded = (
KernelAndKextPatches->KPAppleIntelCPUPM ||
KernelAndKextPatches->KPAppleRTC ||
KernelAndKextPatches->EightApple ||
KernelAndKextPatches->KPDELLSMBIOS ||
(KernelAndKextPatches->KPATIConnectorsPatch != NULL) ||
((KernelAndKextPatches->NrKexts > 0) && (KernelAndKextPatches->KextPatches != NULL))
@ -2305,7 +2326,7 @@ LOADER_ENTRY::KernelAndKextsPatcherStart()
KernelAndKextPatcherInit();
if (KernelData == NULL) goto NoKernelData;
if (EFI_ERROR(getVTable())) {
DBG_RT("error getting vtable: \n");
// DBG_RT("error getting vtable: \n");
goto NoKernelData;
}
patchedOk = KernelUserPatch();

View File

@ -27,26 +27,38 @@
#define SC_GET_CMD(hdr) (((struct segment_command_64*)(hdr))->cmd)
const char kPrelinkTextSegment[] = "__PRELINK_TEXT";
const char kPrelinkTextSection[] = "__text";
const char kPrelinkLinkStateSegment[] = "__PRELINK_STATE";
const char kPrelinkKernelLinkStateSection[] = "__kernel";
const char kPrelinkKextsLinkStateSection[] = "__kexts";
const char kPrelinkInfoSegment[] = "__PRELINK_INFO";
const char kPrelinkInfoSection[] = "__info";
const char kLinkEditSegment[] = "__LINKEDIT";
const char kTextSegment[] = "__TEXT";
const char kDataSegment[] = "__DATA";
const char kDataConstSegment[] = "__DATA_CONST";
const char kKldSegment[] = "__KLD";
const char kPrelinkTextSegment[] = "__PRELINK_TEXT";
const char kPrelinkTextSection[] = "__text";
const char kPrelinkLinkStateSegment[] = "__PRELINK_STATE";
const char kPrelinkKernelLinkStateSection[] = "__kernel";
const char kPrelinkKextsLinkStateSection[] = "__kexts";
const char kPrelinkInfoSegment[] = "__PRELINK_INFO";
const char kPrelinkInfoSection[] = "__info";
const char kLinkEditSegment[] = "__LINKEDIT";
const char kTextSegment[] = "__TEXT";
const char kDataSegment[] = "__DATA";
const char kDataConstSegment[] = "__DATA_CONST";
const char kKldSegment[] = "__KLD";
const char kConstSection[] = "__const";
const char kBssSection[] = "__bss";
const char kCommonSection[] = "__common";
const char kDataSection[] = "__data";
#define ID_SEG_STEXT 0x010e
#define ID_SEG_TEXT 0x010f
#define ID_SEG_TEXT_CONST 0x030e
#define ID_SEG_DATA_DATA 0x080e
#define ID_SEG_DATA_DATA2 0x081e
#define ID_SEC_BSS 0x0a0e
#define ID_SEС_CONST 0x070f
#define ID_SEG_DATA_COMMON 0x090f
#define ID_SEG_DATA 0x0f0f
#define ID_SEG_DATA_CONST 0x110f
#define ID_SEG_KLD 0x180f
#define ID_SEG_KLD2 0x1a0f
const char ctor_used[] = ".constructors_used";
const char kPrelinkBundlePathKey[] = "_PrelinkBundlePath";
const char kPrelinkExecutableRelativePathKey[] = "_PrelinkExecutableRelativePath";
@ -88,10 +100,12 @@ typedef struct VTABLE {
typedef struct SEGMENT {
CHAR8 Name[16]; //0
UINT64 SegAddress; //16 0x10
UINT64 SegAddress; //0x10
UINT64 vmsize; //0x18 0x16FB60
UINT64 fileoff; //0x20 0xDDA000
UINT64 filesize; //0x28 0x16FB60
UINT32 fileoff; //0x20 0xDDA000 //Slice - it is not UINT64. MachoLib is wrong
UINT32 fileoff64; //0x24
UINT32 filesize; //0x28 0x16FB60
UINT32 filesize64; //0x2c
UINT32 maxprot; //0x30 01-Cat 07-Moj
UINT32 initprot; //0x34 01
UINT32 NumSects; //0x38 00
@ -128,8 +142,8 @@ typedef struct SEGMENT {
//VOID Patcher_SSE3_6(VOID* kernelData);
//VOID Patcher_SSE3_7();
#include "../gui/menu_items/menu_items.h" // for LOADER_ENTRY
class LOADER_ENTRY;
//#include "../gui/menu_items/menu_items.h" // for LOADER_ENTRY
//class LOADER_ENTRY;
//VOID KernelAndKextsPatcherStart(IN LOADER_ENTRY *Entry);
//VOID register_kernel_symbol(CONST CHAR8* name);
@ -162,9 +176,10 @@ class LOADER_ENTRY;
UINTN SearchAndCount(const UINT8 *Source, UINT64 SourceSize, const UINT8 *Search, UINTN SearchSize);
BOOLEAN CompareMemMask(const UINT8 *Source, const UINT8 *Search, UINTN SearchSize, const UINT8 *Mask, UINTN MaskSize);
VOID CopyMemMask(UINT8 *Dest, const UINT8 *Replace, const UINT8 *Mask, UINTN SearchSize);
VOID CopyMemMask(UINT8 *Dest, const UINT8 *Replace, const UINT8 *Mask, UINTN SearchSize);
UINTN FindMemMask(const UINT8 *Source, UINTN SourceSize, const UINT8 *Search, UINTN SearchSize, const UINT8 *MaskSearch, UINTN MaskSize);
UINTN FindRelative32(const UINT8 *Source, UINTN Start, UINTN SourceSize, UINTN taskLocation);
UINTN FindSection(const UINT8 *Source, UINTN len, const UINT8* seg, const UINT8* sec);
//
// Searches Source for Search pattern of size SearchSize
// and replaces it with Replace up to MaxReplaces times.

View File

@ -131,6 +131,32 @@ UINTN FindRelative32(const UINT8 *Source, UINTN Start, UINTN SourceSize, UINTN t
return 0;
}
UINTN FindSection(const UINT8 *Source, UINTN len, const UINT8* seg, const UINT8* sec)
{
BOOLEAN eq;
for (UINTN i = 0x20; i < len; i++) {
eq = TRUE;
for (UINTN j = 0; j < 16 && (sec[j] != 0); j++) {
if (Source[i + j] != sec[j]) {
eq = FALSE;
break;
}
}
if (eq) {
for (UINTN j = 0; j < 16 && (seg[j] != 0); j++) {
if (Source[i + 0x10 + j] != seg[j]) {
eq = FALSE;
break;
}
}
if (eq)
return i + 16;
}
}
return 0;
}
UINTN FindMemMask(const UINT8 *Source, UINTN SourceSize, const UINT8 *Search, UINTN SearchSize, const UINT8 *MaskSearch, UINTN MaskSize)
{
if (!Source || !Search || !SearchSize) {
@ -993,7 +1019,35 @@ VOID LOADER_ENTRY::BDWE_IOPCIPatch(UINT8 *Driver, UINT32 DriverSize, CHAR8 *Info
Stall(5000000);
}
VOID LOADER_ENTRY::EightApplePatch(UINT8 *Driver, UINT32 DriverSize)
{
// UINTN procLen = 0;
UINTN procAddr = searchProcInDriver(Driver, DriverSize, "initFB");
UINTN verbose = searchProcInDriver(Driver, DriverSize, "gIOFBVerboseBoot");
UINTN patchLoc = FindRelative32(Driver, procAddr, 0x300, verbose-1);
if (patchLoc != 0 && Driver[patchLoc + 1] == 0x75) {
Driver[patchLoc + 1] = 0xEB;
// DBG_RT("8 apples patch success\n");
} else {
DBG_RT("8 apples patch not found, loc=0x%llx\n", patchLoc);
// if (patchLoc != 0) {
// for (int i=0; i<10; ++i) {
// DBG_RT("%02x", Driver[patchLoc+i]);
// }
// DBG_RT("\n");
// } else if (procAddr != 0) {
// for (int i=0; i<10; ++i) {
// DBG_RT("%02x", Driver[procAddr+i]);
// }
// DBG_RT("\n");
// }
// DBG_RT(" procAddr=0x%llx\n", procAddr);
// DBG_RT(" verbose=0x%llx\n", verbose);
// Stall(20000000);
}
Stall(5000000);
}
////////////////////////////////////
//
@ -1192,7 +1246,18 @@ VOID LOADER_ENTRY::PatchKext(UINT8 *Driver, UINT32 DriverSize, CHAR8 *InfoPlist,
// SandyBridge-E AppleIntelCPUPowerManagement Patch implemented by syscl
//
SNBE_AICPUPatch(Driver, DriverSize, InfoPlist, InfoPlistSize);
} else if (KernelAndKextPatches->EightApple &&
/* (AsciiStrStr(InfoPlist, "com.apple.iokit.IOGraphicsFamily") != NULL) && */
(AsciiStrStr(InfoPlist, "I/O Kit Graphics Family") != NULL)) {
//
// Patch against 8 apple glitch
//
DBG_RT("Patch 8 apple required, IOGraphicsFamily...\n");
EightApplePatch(Driver, DriverSize);
Stall(10000000);
}
//com.apple.iokit.IOGraphicsFamily
for (INT32 i = 0; i < KernelAndKextPatches->NrKexts; i++) {
CHAR8 *Name = KernelAndKextPatches->KextPatches[i].Name;
BOOLEAN isBundle = (AsciiStrStr(Name, ".") != NULL);

View File

@ -460,6 +460,7 @@ class REFIT_ABSTRACT_MENU_ENTRY
BOOLEAN BroadwellEPM();
BOOLEAN KernelIvyBridgeXCPM();
BOOLEAN KernelIvyE5XCPM();
void EightApplePatch(UINT8 *Driver, UINT32 DriverSize);
void Stall(int Pause) { if ((KernelAndKextPatches != NULL) && KernelAndKextPatches->KPDebug) { gBS->Stall(Pause); } };
void StartLoader();

View File

@ -316,7 +316,8 @@ typedef struct KERNEL_AND_KEXT_PATCHES
BOOLEAN KPAppleRTC;
BOOLEAN KPDELLSMBIOS; // Dell SMBIOS patch
BOOLEAN KPPanicNoKextDump;
UINT8 pad[3];
BOOLEAN EightApple;
UINT8 pad[7];
UINT32 FakeCPUID;
// UINT32 align0;
CHAR8 *KPATIConnectorsController;

View File

@ -288,9 +288,8 @@ VOID FillInputs(BOOLEAN New)
InputItemsCount = 44;
InputItems[InputItemsCount].ItemType = BoolValue; //44
InputItems[InputItemsCount++].BValue = gSettings.KextPatchesAllowed;
// InputItems[InputItemsCount].ItemType = BoolValue; //45
// InputItems[InputItemsCount++].BValue = gSettings.KernelAndKextPatches.KPKernelCpu;
InputItemsCount++; //vacant place for id = 45
InputItems[InputItemsCount].ItemType = BoolValue; //45
InputItems[InputItemsCount++].BValue = gSettings.KernelAndKextPatches.EightApple;
InputItems[InputItemsCount].ItemType = BoolValue; //46
InputItems[InputItemsCount++].BValue = gSettings.KernelAndKextPatches.KPAppleIntelCPUPM;
InputItems[InputItemsCount].ItemType = BoolValue; //47
@ -797,10 +796,10 @@ VOID ApplyInputs(VOID)
gSettings.KextPatchesAllowed = InputItems[i].BValue;
gBootChanged = TRUE;
}
i++; //45 - vacant
i++; //45
if (InputItems[i].Valid) {
// gSettings.KernelAndKextPatches.KPKernelCpu = InputItems[i].BValue;
// gBootChanged = TRUE;
gSettings.KernelAndKextPatches.EightApple = InputItems[i].BValue;
gBootChanged = TRUE;
}
i++; //46
if (InputItems[i].Valid) {
@ -2136,16 +2135,15 @@ REFIT_ABSTRACT_MENU_ENTRY* SubMenuBinaries()
SubScreen->AddMenuItemInput(64, "Debug", FALSE);
SubScreen->AddMenuInfo_f("----------------------");
SubScreen->AddMenuItemInput(104, "Fake CPUID:", TRUE);
// SubScreen->AddMenuItemInput(108, "Kernel patching allowed", FALSE);
// SubScreen->AddMenuItemInput(45, "Kernel Support CPU", FALSE);
SubScreen->AddMenuItemInput(91, "Kernel Lapic", FALSE);
SubScreen->AddMenuItemInput(105, "Kernel XCPM", FALSE);
SubScreen->AddMenuItemInput(48, "Kernel PM", FALSE);
SubScreen->AddMenuItemInput(121, "Panic No Kext Dump", FALSE);
SubScreen->AddMenuItemInput(121, "Panic No Kext Dump", FALSE);
SubScreen->AddMenuEntry(SubMenuKernelPatches(), true);
SubScreen->AddMenuInfo_f("----------------------");
SubScreen->AddMenuItemInput(46, "AppleIntelCPUPM Patch", FALSE);
SubScreen->AddMenuItemInput(47, "AppleRTC Patch", FALSE);
SubScreen->AddMenuItemInput(45, "No 8 Apples Patch", FALSE);
SubScreen->AddMenuItemInput(61, "Dell SMBIOS Patch", FALSE);
// SubScreen->AddMenuItemInput(115, "No Caches", FALSE);
// SubScreen->AddMenuItemInput(44, "Kext patching allowed", FALSE);
@ -2179,8 +2177,7 @@ REFIT_ABSTRACT_MENU_ENTRY* SubMenuDropTables()
// sign, DropTable->Signature,
// OTID, DropTable->TableId,
// DropTable->Length, DropTable->Length);
// InputBootArgs = (__typeof__(InputBootArgs))AllocateZeroPool(sizeof(REFIT_INPUT_DIALOG));
InputBootArgs = new REFIT_INPUT_DIALOG;
InputBootArgs = new REFIT_INPUT_DIALOG;
InputBootArgs->Title.SWPrintf("Drop \"%4.4s\" \"%8.8s\" %d", sign, OTID, DropTable->Length);
// InputBootArgs->Tag = TAG_INPUT;
InputBootArgs->Row = 0xFFFF; //cursor
@ -2196,12 +2193,10 @@ REFIT_ABSTRACT_MENU_ENTRY* SubMenuDropTables()
SubScreen->AddMenuItemInput(4, "Drop all OEM SSDT", FALSE);
SubScreen->AddMenuItemInput(113, "Automatic smart merge", FALSE);
//SubScreen->AddMenuInfoLine_f("PATCHED AML:");
if (ACPIPatchedAML) {
ACPI_PATCHED_AML *ACPIPatchedAMLTmp = ACPIPatchedAML;
while (ACPIPatchedAMLTmp) {
// InputBootArgs = (__typeof__(InputBootArgs))AllocateZeroPool(sizeof(REFIT_INPUT_DIALOG));
InputBootArgs = new REFIT_INPUT_DIALOG;
InputBootArgs = new REFIT_INPUT_DIALOG;
InputBootArgs->Title.SWPrintf("Drop \"%ls\"", ACPIPatchedAMLTmp->FileName);
// InputBootArgs->Tag = TAG_INPUT;
InputBootArgs->Row = 0xFFFF; //cursor