NOTE none of this stuff works from 1.1.2 onwards... *sigh*
Added some filesystem stuff. dumpfs and restore are kinda fun ;)
imac /diskdev_cmds-332.22/ cd fscmds
imac /fscmds/ file *
README: ASCII text
dev_mkdb: Mach-O executable acorn
dump: Mach-O executable acorn
dumpfs: Mach-O executable acorn
mount: Mach-O executable acorn
mount_cd9660: Mach-O executable acorn
mount_devfs: Mach-O executable acorn
mount_fdesc: Mach-O executable acorn
mount_nfs: Mach-O executable acorn
mount_synthfs: Mach-O executable acorn
newfs_msdos: Mach-O executable acorn
restore: Mach-O executable acorn
tunefs: Mach-O executable acorn
umount: Mach-O executable acorn
vndevice: Mach-O executable acorn
vsdbutil: Mach-O executable acorn
Added launchd binary suite:
imac /src/ file launch_progs/*
launch_progs/ConsoleMessage: Mach-O executable acorn
launch_progs/StartupItemContext: Mach-O executable acorn
launch_progs/SystemStarter: Mach-O executable acorn
launch_progs/launchctl: Mach-O executable acorn
launch_progs/launchd: Mach-O executable acorn
launch_progs/launchd_debugd: Mach-O executable acorn
launch_progs/launchproxy: Mach-O executable acorn
launch_progs/register_mach_bootstrap_servers: Mach-O executable acorn
launch_progs/wait4path: Mach-O executable acorn
Getting a lot closer to a working module setup now
Thumb and ARM funcs are mixed in the kernel
Makes me think of this link where they mention -mlong-calls -mthumb-interwork
http://mail-index.netbsd.org/port-arm/2004/08/21/0000.html
Not all funcs are thumb code as found today:
static void (*addlog)(const char * fmt, ...) = 0xc010411c + 1; // thumb !!
static long * (*cpuid_info)(void) = 0xc005a5d4; //arm.
kern_return_t MyKextStart (kmod_info_t * ki, void * d) {
addlog("KEXT loaded!\n");
long * val = cpuid_info();
addlog("CPUID Result: %08x\n", *val);
return KERN_SUCCESS;
}
# tail -2 /var/log/syslog
Oct 13 18:48:35 localhost kernel[0]: KEXT loaded!
Oct 13 18:48:35 localhost kernel[0]: CPUID Result: 4107b761
I need to read up here!
http://www.coranac.com/tonc/text/asm.htm
bgm's patches confirmed!
All we needed was:
echo -en "\x08\x1C\x11\x1C\x85\xE7" | dd of=/dev/kmem seek=3221581156 bs=1 count=6
And this magic to redefine "printf":
imac /kernel/ diff mykext.orig.c mykext.bgm.c
3a4,5
> void (*p)(const char * fmt, ...) = 0xc010411c + 1; // addlog() THUMB!!!
>
5c7
< printf("Hello, World!\n");
---
> (*p)("Hello, World!\n");
10c12
< printf("Goodbye, World!\n");
---
> (*p)("Goodbye, World!\n");
Now we have this working:
# kextload -v 3 /System/Library/Extensions/MyKext.kext
kextload: adding repository /System/Library/Extensions
kextload: scanning repository /System/Library/Extensions
kextload: request to clear relationships while disabled; pending
kextload: request to clear relationships while disabled; pending
kextload: added repository /System/Library/Extensions
kextload: request to clear relationships while disabled; pending
kextload: request to add kernel extension /System/Library/Extensions/MyKext.kext
kextload: kernel extension /System/Library/Extensions/MyKext.kext exists
kextload: clearing all version/dependency relationships among kernel extensions
kextload: extension /System/Library/Extensions/MyKext.kext appears to be loadable
kextload: loading extension /System/Library/Extensions/MyKext.kext
kextload: calculating version relationships
kextload: sending 1 personality to the kernel
kextload: link/loading file /System/Library/Extensions/System6.0.kext/kernel.6.0
kextload: link/loading file /System/Library/Extensions/MyKext.kext/MyKext
kextload: allocated 8192 bytes in kernel space at 0xf34cc000
kextload: using load address of 0xf34cc000
kextload: kmod name: net.wickedpsyched.MyKext
kextload: kmod start @ 0xf34cd0b0 (offset 0x3e0)
kextload: kmod stop @ 0xf34cd0dc (offset 0x40c)
kextload: module net.wickedpsyched.MyKext created as # 71 at address 0xf34cc000, size 8192
kextload: module # 71 reference counts incremented
kextload: module # 71 started
kextload: /System/Library/Extensions/MyKext.kext loaded successfully
kextload: extension /System/Library/Extensions/MyKext.kext has no personalities
# kextstat | grep My
71 0 0xf34cc000 0x2000 0x1000 net.wickedpsyched.MyKext (1.4.3) <12>
# kextunload /System/Library/Extensions/MyKext.kext
kextunload: unload kext /System/Library/Extensions/MyKext.kext succeeded
# tail -2 /var/log/syslog
Oct 13 13:21:57 localhost kernel[0]: Hello, World!
Oct 13 13:23:36 localhost kernel[0]: Goodbye, World!
More stuff from here http://uninformed.org/index.cgi?v=4&a=3&p=17
Code here:
Build this as "ptrace":
#include <stdio.h>
#include <sys/types.h>
#include <sys/ptrace.h>
static int changeme = 0;
int main(int ac, char **av) { ptrace(PT_DENY_ATTACH, 0, 0, 0);
while(1) { if(changeme) { printf("[+] hacked.\n"); exit(1); } }
return 1;}
Then get the address like so:
imac /kernel/ nm a.out | grep chang
00002030 b _changeme
then build and compile this as "ptrace.hackme":
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <mach/mach.h>
#include <dlfcn.h>
#define CHANGEMEADDR 0x2030
int main(int ac, char **av) {
mach_port_t port;
long content = 1;
if(task_for_pid(mach_task_self(), atoi(av[1]), &port))
error("_|_");
if(vm_write(port, (vm_address_t) CHANGEMEADDR, (vm_address_t)&content, sizeof(content)))
error("writing to process");
return 0;
}
This shows code attaching to a running PID, and calling mach_task_self()
iPhone# ./ptrace &
[1] 267
iPhone# ps aux | grep ptrace
root 267 91.5 0.0 264648 284 p1 RN 2:59PM 0:03.15 ./ptrace
root 269 0.0 0.0 273028 408 p1 S+ 2:59PM 0:00.02 grep ptrace
iPhone# ./ptrace.hackme 267
iPhone# [+] hacked.
Loading Kexts after the mach patch
bgm, and Zf found this gem http://iphone.fiveforty.net/wiki/index.php/Kernel_Manipulation:
use Fcntl;
$a = hex("C011db66");
sysopen(HANDLE, "/dev/kmem", O_RDWR);
$r = sysseek(HANDLE, $a, SEEK_SET);
printf("seek = %x\n", $r);
$r = syswrite(HANDLE, pack("H*", "012B"), 2);
printf("write: %x\n", $r);
close(HANDLE);
Turbo gave me this to do the same thing:
13:52 you can add this to the page for ppl that don't have perl
13:52 echo -en "\x01\x2B" | dd of=/dev/kmem seek=3222395750 bs=1
count=2
(sweet!)
We can now access mach_ports with the pid0 code below:
# ./pid0 -1
KERN_SUCCESS: 0 MACH_PORT_VALID: 1
[+] done!
kern.securelevel = -1
# ./pid0 0
KERN_SUCCESS: 0 MACH_PORT_VALID: 1
[+] done!
kern.securelevel = 0
Also after running this, we can now allocate memory inside the kernel:
the MyKext I'm using is above:
#include <libkern/libkern.h>
#include <mach/mach_types.h>
kern_return_t MyKextStart(kmod_info_t *ki, void *d) {
printf("Hello, World!\n");
return KERN_SUCCESS;
}
kern_return_t MyKextStop(kmod_info_t *ki, void *d) {
printf("Goodbye, World!\n");
return KERN_SUCCESS;
}
extern kern_return_t _start(kmod_info_t *ki, void *data);
extern kern_return_t _stop(kmod_info_t *ki, void *data);
KMOD_EXPLICIT_DECL(net.wickedpsyched.MyKext, "1.0", _start, _stop)
__private_extern__ kmod_start_func_t *_realmain = MyKextStart;
__private_extern__ kmod_stop_func_t *_antimain = MyKextStop;
__private_extern__ int _kext_apple_cc = __APPLE_CC__;
# kextload -v 6 -b net.wickedpsyched.MyKext
kextload: patching C++ code in module /System/Library/Extensions/MyKext.kext/MyKext
kextload: link/loading file /System/Library/Extensions/System6.0.kext/kernel.6.0
kextload: link/loading file /System/Library/Extensions/MyKext.kext/MyKext
kextload: allocated 8192 bytes in kernel space at 0xf34e0000
kextload: using load address of 0xf34e0000
But alas we fail here:
kld(): /System/Library/Extensions/MyKext.kext/MyKext relocation overflow for relocation entry 1 in section (__TEXT,__text) (displacement too large)
kld(): /System/Library/Extensions/MyKext.kext/MyKext relocation overflow for relocation entry 3 in section (__TEXT,__text) (displacement too large)
there is some info here (this may be related to mismatched gcc versions):
http://lists.apple.com/archives/Darwin-kernel/2005/Jan/msg00032.html that shows a potential issue.
We need Patrick on this one :)
Writing to the kmem
Albeit we have r/w access to the kernel (thanks bgm)
This still does not work:
iPhone# cat /dev/kmem
cat: /dev/kmem: Bad address
Owch.
So further attempts to change:
kern.secure_kernel=1 to kern.secure_kernel=0 are not going so well.
However this code (many thanks to Zf!) is very interesting:
using this to get the address:
imac /~/ zgrep secure_kernel toolchain/KERNEL/obj3/nm_obj3.txt.gz
c01c412c D _sysctl__kern_secure_kernel
then this code to poke at it:
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
unsigned char b=0;
int main(int argc, char **argv) {
int mem;
char data[4];
int i;
mem = open("/dev/kmem", O_RDWR);
if (mem<0) {
printf("Oops !\n");
return 0;
}
if (lseek(mem, (off_t)0xC01C412C, SEEK_SET) != 0xC01C412C) {
perror("lseek");
return 1;
}
if (read(mem, data, 4) == 1) {
perror("read");
printf("secure_kern: %.2x ", data[i]);
}
printf("\n");
printf("Data match : %d %d %d %d \n",data[0],data[1],data[2],data[3]);
lseek(mem, (off_t)0xC01C412C, SEEK_SET);
if (write(mem, &b, 4) == 1) {
perror("write");
return 1;
}
close(mem);
return 1;
}
Results in:
iPhone# ./zf
Data match : 48 162 30 192
iPhone# ./zf
Data match : 0 0 0 0
iPhone# ./zf
Data match : 0 0 0 0
but alas:
kern.secure_kernel=1 persists... shame
more kmods
Thanks to bgm, we have write access to kvm:
http://iphone.fiveforty.net/wiki/index.php/Kernel_Manipulation
We can now see:
12:49 <+core> # sysctl -w kern.securelevel=0
12:49 <+core> kern.securelevel: 0 -> 0
12:49 <+core> # sysctl -w kern.securelevel=1
12:49 <+core> kern.securelevel: 0 -> 1
12:49 <+core> # sysctl -w kern.securelevel=0
12:49 <+core> kern.securelevel: Operation not permitted
I worked on this code here http://uninformed.org/index.cgi?v=4&a=3&p=17
changing the adress from the following:
imac /KERNEL/ nm obj3/kernelcache.release.s5l8900xrb | grep secure
c01e8bac S _securelevel
c01c412c D _sysctl__kern_secure_kernel
#include <mach/mach.h>
#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>
#define SECURELEVELADDR 0xc01e8bac
void error(char *msg) {
printf("[!] error: %s\n",msg);
exit(1);
}
void usage(char *progname) {
printf("[+] usage: %s \n",progname);
exit(1);
}
int main(int ac, char **av) {
mach_port_t kernel_task;
kern_return_t err;
long value = 0;
if(ac != 2) usage(*av);
if(getuid() && geteuid()) error("requires root.");
value = atoi(av[1]);
err = task_for_pid(mach_task_self(),0,&kernel_task);
if ((err != KERN_SUCCESS) || !MACH_PORT_VALID(kernel_task))
error("getting kernel task.");
// Write values to stack.
if(vm_write(kernel_task, (vm_address_t) SECURELEVELADDR, (vm_address_t)&value, sizeof(value)))
error("writing argument to dlopen.");
printf("[+] done!\n");
return 0;
}
But alas have no access to task_for_pid 0:
13:13 <+core> # ./pid0 -1
13:13 <+core> KERN_SUCCESS: 0 MACH_PORT_VALID: 0
13:09 <+core> [!] error: getting kernel task.
And this piece no worky yet:
12:40 <+core> # sysctl -w kern.secure_kernel=0
12:40 <+core> sysctl: oid 'kern.secure_kernel' is read only
The kext stuff below, still errors with:
# kextload -v 6 -b net.wickedpsyched.MyKext
kextload: unable to get kernel task port: (os/kern) failure
kcache unpack
We have the kernel decoded:
You will need these 2 things:
http://www.crosswire.org/sword/software/swordapi.jsp
http://iphone.fiveforty.net/wiki/index.php/Unpack_89001.0.c
A lot of this is based on
http://www.appletvhacks.net/2007/03/26/hidden-files-in-the-apple-tv-kern...
Thanks SAM!!
here we go:
imac /obj3/ scp root@iphone:/System/Library/Caches/com.apple.kernelcaches/kernelcache.release.s5l8900xrb .
kernelcache.release.s5l8900xrb 100% 3186KB 1.0MB/s 00:03
imac /obj3/ ../unpack.89001 kernelcache.release.s5l8900xrb kernelcache.release.s5l8900xrb.unpack
imac /obj3/ dd if=kernelcache.release.s5l8900xrb.unpack of=kernelcache.release.s5l8900xrb.lzs skip="1" bs="384"
8480+1 records in
8480+1 records out
3256350 bytes transferred in 0.091624 secs (35540445 bytes/sec)
imac /obj3/ ../lz/sword-1.5.9/tests/complzss kernelcache.release.s5l8900xrb.lzs
imac /obj3/ file kernelcache.release.s5l8900xrb
kernelcache.release.s5l8900xrb: Mach-O executable acorn
imac /obj3/ nm kernelcache.release.s5l8900xrb | head -4
c01c5abc D .constructors_used
c01c5ac4 D .destructors_used
c00e3ef8 T _AllocateNode
c0019944 T _Assert
imac /obj3/ nm kernelcache.release.s5l8900xrb | tail -4
c002a6a4 T _zone_steal_memory
c0059c08 T _zone_virtual_addr
c01acae0 D _zone_zone
c002addc T _zprealloc
Now we can install the kernel:
mac /obj3/ scp kernelcache.release.s5l8900xrb root@iphone:/mach
kernelcache.release.s5l8900xrb 100% 5755KB 822.1KB/s 00:07
This page is a big help:
http://iphone.fiveforty.net/wiki/index.php/KernelCache_Files_List
TestingModules has the following:
# tar cfv TestingModules.tgz /System/Library/Extensions/MyKext.kext /System/Library/Extensions/System6.0.kext
tar: Removing leading `/' from member names
/System/Library/Extensions/MyKext.kext/
/System/Library/Extensions/MyKext.kext/Info.plist
/System/Library/Extensions/MyKext.kext/MyKext
/System/Library/Extensions/System6.0.kext/
/System/Library/Extensions/System6.0.kext/Info.plist
/System/Library/Extensions/System6.0.kext/kernel.6.0
/System/Library/Extensions/System6.0.kext/version.plist
Current result of a load:
# kextload -v 6 -b net.wickedpsyched.MyKext
kextload: adding repository /System/Library/Extensions
kextload: scanning repository /System/Library/Extensions
kextload: scanning directory /System/Library/Extensions
kextload: found valid extension AppleMultitouchSPI.kext
kextload: found valid extension IOHIDFamily.kext
kextload: found valid extension MyKext.kext
kextload: found valid extension PPP.kext
kextload: found valid extension System.kext
kextload: scanning directory /System/Library/Extensions/AppleMultitouchSPI.kext/PlugIns
kextload: scanning directory /System/Library/Extensions/IOHIDFamily.kext/PlugIns
kextload: found valid extension IOHIDFamily.kext/PlugIns/IOHIDEventDriver.kext
kextload: found valid extension IOHIDFamily.kext/PlugIns/IOHIDEventDriverSafeBoot.kext
kextload: found valid extension IOHIDFamily.kext/PlugIns/IOHIDSystem.kext
kextload: scanning directory /System/Library/Extensions/MyKext.kext/PlugIns
kextload: scanning directory /System/Library/Extensions/PPP.kext/PlugIns
kextload: scanning directory /System/Library/Extensions/System.kext/PlugIns
kextload: found valid extension System.kext/PlugIns/BSDKernel.kext
kextload: found valid extension System.kext/PlugIns/IOKit.kext
kextload: found valid extension System.kext/PlugIns/Libkern.kext
kextload: found valid extension System.kext/PlugIns/Mach.kext
kextload: found valid extension System.kext/PlugIns/System6.0.kext
kextload: found valid extension System.kext/PlugIns/Unsupported.kext
kextload: request to clear relationships while disabled; pending
kextload: request to clear relationships while disabled; pending
kextload: added repository /System/Library/Extensions
kextload: request to clear relationships while disabled; pending
kextload: clearing all version/dependency relationships among kernel extensions
kextload: calculating version relationships
kextload: looking up extension with identifier net.wickedpsyched.MyKext
kextload: found extension bundle /System/Library/Extensions/MyKext.kext
kextload: extension /System/Library/Extensions/MyKext.kext appears to be loadable
kextload: loading extension /System/Library/Extensions/MyKext.kext
kextload: resolving dependencies for extension /System/Library/Extensions/MyKext.kext
kextload: looking for dependency of extension
/System/Library/Extensions/MyKext.kext with ID com.apple.kernel.6.0,
compatible with version 7.9.9
kextload: found compatible dependency from extension
/System/Library/Extensions/MyKext.kext to
/System/Library/Extensions/System.kext/PlugIns/System6.0.kext;
resolving its dependencies
kextload: /System/Library/Extensions/System.kext/PlugIns/System6.0.kext
is a kernel resource and thus has no dependencies
kextload: authenticating extension
/System/Library/Extensions/System.kext/PlugIns/System6.0.kext
kextload: authenticating bundle directory /System/Library/Extensions/System.kext/PlugIns/System6.0.kext
kextload: authenticating file/directory "/System/Library/Extensions/System.kext/PlugIns/System6.0.kext/Info.plist"
kextload: authenticating file/directory "/System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel"
kextload: extension /System/Library/Extensions/System.kext/PlugIns/System6.0.kext is authentic
kextload: authenticating extension /System/Library/Extensions/MyKext.kext
kextload: authenticating bundle directory /System/Library/Extensions/MyKext.kext
kextload: authenticating file/directory "/System/Library/Extensions/MyKext.kext/Info.plist"
kextload: authenticating file/directory "/System/Library/Extensions/MyKext.kext/MyKext"
kextload: extension /System/Library/Extensions/MyKext.kext is authentic
kextload: sending 1 personality to the kernel
kextload: loading dependency graph:
kextload: flattened dependency list:
kextload: /System/Library/Extensions/MyKext.kext/MyKext
kextload: is kernel component: no
kextload: expected kmod name: [net.wickedpsyched.MyKext]
kextload: expected kmod vers: [1.0]
kextload: /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel
kextload: is kernel component: yes
kextload: expected kmod name: [com.apple.kernel.6.0]
kextload: expected kmod vers: [7.9.9]
kextload:
kextload: load order dependency list:
kextload: /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel
kextload: /System/Library/Extensions/MyKext.kext/MyKext
kextload:
kextload: dependency graph:
kextload: /System/Library/Extensions/MyKext.kext/MyKext ->
/System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel
kextload:
kextload: getting module addresses from kernel
kextload: mapping the kernel file /mach
kextload: mapping module file /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel
kextload: mapping module file /System/Library/Extensions/MyKext.kext/MyKext
kextload: checking whether module file com.apple.kernel.6.0 is already loaded
kextload: checking whether module file net.wickedpsyched.MyKext is already loaded
kextload: mapping the kernel file /mach
kextload: mapping module file /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel
kextload: module file /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel is already mapped
kextload: mapping module file /System/Library/Extensions/MyKext.kext/MyKext
kextload: module file /System/Library/Extensions/MyKext.kext/MyKext is already mapped
kextload: patching C++ code in module /System/Library/Extensions/MyKext.kext/MyKext
kextload: unable to get kernel task port: (os/kern) failure
kextload: you must be running as root to load modules into the kernel
kextload: a link/load error occured for kernel extension /System/Library/Extensions/MyKext.kext
kextload: clearing all version/dependency relationships among kernel extensions
kextload: sending 1 personality to the kernel
![[file]](http://www.wickedpsyched.com/iphone/modules/webfm/image/icon/f.gif "Download ANNOTATEDKEXT.html"){kind=icon}
ANNOTATEDKEXT.html