mirror of
https://github.com/palera1n/palera1n.git
synced 2026-10-21 09:47:01 +02:00
Merge branch 'main' into koputer
This commit is contained in:
13 files changed
+4052
-1
No files matched your search
@@ -223,7 +223,6 @@ Exit after booting into a clean PongoOS shell.
|
||||
Specify custom XNU kernel command line. Additionally, the
|
||||
.Em wdt=-1
|
||||
argument is used during fakefs setup.
|
||||
|
||||
.It Fl k , -override-pongo Ar pongo file
|
||||
Override PongoOS image. The raw image, named
|
||||
.Em Pongo.bin
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
C_SRC = $(wildcard *.c)
|
||||
C_OBJS = $(patsubst %,../$(OBJDIR)/%,$(C_SRC:.c=.c.o))
|
||||
|
||||
S_SRC = $(wildcard *.S)
|
||||
S_OBJS = $(patsubst %,../$(OBJDIR)/%,$(S_SRC:.S=.S.o))
|
||||
|
||||
CFLAGS += -fvisibility=hidden
|
||||
|
||||
C_OBJS += ../$(GENDIR)/gen-payload-t7000.c.o ../$(GENDIR)/gen-payload-t8011.c.o ../$(GENDIR)/gen-payload-t8012.c.o
|
||||
|
||||
all: ../$(RESOURCES_DIR)/libcheckra1nhelper.dylib
|
||||
|
||||
../$(OBJDIR)/%.c.o: %.c
|
||||
$(CC) $(CFLAGS) -c -o $@ $<
|
||||
|
||||
../$(OBJDIR)/%.S.o: %.S
|
||||
$(CC) $(CFLAGS) -c -o $@ $<
|
||||
|
||||
../$(RESOURCES_DIR)/libcheckra1nhelper.dylib: $(C_OBJS) $(S_OBJS) $(wildcard *.h)
|
||||
$(CC) $(CFLAGS) $(LDFLAGS) -shared $(C_OBJS) $(S_OBJS) -o $@
|
||||
$(STRIP) -x $@
|
||||
codesign -fs - $@
|
||||
|
||||
../$(GENDIR)/gen-payload-%.c: payloads/%.bin
|
||||
echo '#include <stdint.h>' > $@
|
||||
cd payloads && xxd -iC $$(echo $< | cut -d/ -f2) | sed -e 's/unsigned int/uint32_t/' -e 's/unsigned char/uint8_t/' >> ../$@
|
||||
|
||||
../$(GENDIR)/gen-payload-%.c.o: ../$(GENDIR)/gen-payload-%.c
|
||||
$(CC) $(CFLAGS) -c -o $@ $<
|
||||
@@ -0,0 +1,88 @@
|
||||
#include <mach-o/loader.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <assert.h>
|
||||
#include <string.h>
|
||||
#include <mach-o/dyld.h>
|
||||
#include <sys/ptrace.h>
|
||||
#include <spawn.h>
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
#include <limits.h>
|
||||
#include <TargetConditionals.h>
|
||||
|
||||
#include "phookra1n.h"
|
||||
|
||||
extern char **environ;
|
||||
extern char ***_NSGetArgv(void);
|
||||
extern int *_NSGetArgc(void);
|
||||
|
||||
#define CS_OPS_STATUS 0
|
||||
#define CS_DEBUGGED 0x10000000
|
||||
|
||||
int csops(pid_t pid, unsigned int ops, void *useraddr, size_t usersize);
|
||||
|
||||
__attribute__((constructor)) void ctor(void)
|
||||
{
|
||||
char ***argvp = _NSGetArgv();
|
||||
int *argcp = _NSGetArgc();
|
||||
|
||||
assert(argvp);
|
||||
assert(argcp);
|
||||
|
||||
int argc = *argcp;
|
||||
char **argv = *argvp;
|
||||
|
||||
#if TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR
|
||||
assert(ptrace(PT_TRACE_ME, 0, 0, 0) == 0);
|
||||
uint32_t csflags;
|
||||
assert(csops(getpid(), CS_OPS_STATUS, &csflags, sizeof(csflags)) == 0);
|
||||
|
||||
if (!(csflags & CS_DEBUGGED))
|
||||
printf("WARNING: CS_DEBUGGED is not set (0x%x)\n", csflags);
|
||||
#endif
|
||||
|
||||
char *c1_path = getenv("LIBCHECKRA1NHELPER_CHECKRA1N_PATH");
|
||||
|
||||
assert(c1_path);
|
||||
|
||||
dprintf("Welcome to Checkra1n Hook!\n");
|
||||
|
||||
int c1_image_index = 0;
|
||||
for (uint32_t i = 0; i < _dyld_image_count(); i++) {
|
||||
if(!strcmp(_dyld_get_image_name(i), c1_path)) {
|
||||
c1_image_index = i;
|
||||
break;
|
||||
}
|
||||
}
|
||||
intptr_t slide = _dyld_get_image_vmaddr_slide(c1_image_index);
|
||||
struct mach_header_64 *mach_header = (struct mach_header_64*)_dyld_get_image_header(c1_image_index);
|
||||
|
||||
uintptr_t cmd_current = (uintptr_t)(mach_header + 1);
|
||||
uintptr_t cmd_end = cmd_current + mach_header->sizeofcmds;
|
||||
|
||||
const struct segment_command_64 *__TEXT = NULL;
|
||||
|
||||
for (uint32_t i = 0; i < mach_header->ncmds && cmd_current <= cmd_end; i++) {
|
||||
const struct segment_command_64 *cmd;
|
||||
|
||||
cmd = (struct segment_command_64*)cmd_current;
|
||||
cmd_current += cmd->cmdsize;
|
||||
|
||||
if (cmd->cmd != LC_SEGMENT_64 || strcmp(cmd->segname, "__TEXT")) {
|
||||
continue;
|
||||
}
|
||||
__TEXT = cmd;
|
||||
}
|
||||
|
||||
assert(__TEXT);
|
||||
|
||||
#if defined(__x86_64__)
|
||||
assert(__TEXT->vmsize == 0x28000);
|
||||
setup_hooks_x86_64((void*)(__TEXT->vmaddr + slide));
|
||||
#elif defined(__arm64__)
|
||||
assert(__TEXT->vmsize == 0x24000);
|
||||
setup_hooks_arm64((void*)(__TEXT->vmaddr + slide));
|
||||
#endif
|
||||
}
|
||||
|
||||
@@ -0,0 +1,69 @@
|
||||
#include <stdio.h>
|
||||
#include <assert.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <mach/mach.h>
|
||||
#include <mach/error.h>
|
||||
#include <mach/vm_prot.h>
|
||||
#include <libkern/OSCacheControl.h>
|
||||
#include "phookra1n.h"
|
||||
|
||||
#if defined(__arm64__)
|
||||
|
||||
static void patch(uint32_t *stream, const uint8_t *payload, const uint32_t payload_len)
|
||||
{
|
||||
uint64_t from = (uint64_t)stream;
|
||||
uint64_t to = (uint64_t)payload;
|
||||
|
||||
uint32_t adrp_off = ((to & ~0xfff) - (from & ~0xfff)) >> 12;
|
||||
uint32_t add_off = to & 0xfff;
|
||||
|
||||
dprintf("from 0x%llx to 0x%llx 0x%llx 0x%x\n", from, to, ((from & ~0xfff) + (adrp_off << 12)), add_off);
|
||||
|
||||
uint8_t adrp_reg = stream[0] & 0x1f;
|
||||
uint8_t add_reg = stream[1] & 0x1f;
|
||||
uint8_t mov1_reg = stream[2] & 0x1f;
|
||||
uint8_t mov2_reg = stream[3] & 0x1f;
|
||||
|
||||
uint8_t immlo = adrp_off & 0x3;
|
||||
uint8_t immhi = (adrp_off >> 2) & 0x7ffff;
|
||||
|
||||
stream[0] = 0x90000000 | adrp_reg | immlo << 29 | (immhi << 5);
|
||||
stream[1] = 0x91000000 | add_reg | add_reg << 5 | (add_off & 0xfff) << 10;
|
||||
stream[2] = 0x52800000 | mov1_reg | ((payload_len & 0xffff) << 5);
|
||||
stream[3] = 0x52800000 | mov2_reg | ((payload_len & 0xffff) << 5);
|
||||
|
||||
dprintf("patched: 0x%x 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2], stream[3]);
|
||||
}
|
||||
|
||||
void setup_hooks_arm64(void *stream)
|
||||
{
|
||||
uint32_t
|
||||
*t8011_patch_base = (uint32_t*)((char*)stream + 0x102E0),
|
||||
*t7000_patch_base = (uint32_t*)((char*)stream + 0x102F4),
|
||||
*t8012_patch_base = (uint32_t*)((char*)stream + 0x10290);
|
||||
|
||||
vm_address_t page = (vm_address_t)((char*)stream + 0x10000);
|
||||
|
||||
assert(*t8011_patch_base == 0x90000081); // T8011
|
||||
assert(*t7000_patch_base == 0x90000061); // T7000
|
||||
assert(*t8012_patch_base == 0xd0000081); // T8012
|
||||
|
||||
assert(vm_protect(mach_task_self(), page, 0x4000, false, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY) == 0);
|
||||
|
||||
uint32_t t7000_shared_len = 0xaa4; // shared with T7001
|
||||
if (t7000_bin_len > t7000_shared_len)
|
||||
t7000_shared_len = t7000_bin_len;
|
||||
|
||||
patch(t7000_patch_base, t7000_bin, t7000_shared_len);
|
||||
patch(t8011_patch_base, t8011_bin, t8011_bin_len);
|
||||
patch(t8012_patch_base, t8012_bin, t8012_bin_len);
|
||||
|
||||
assert(vm_protect(mach_task_self(), page, 0x4000, false, VM_PROT_READ | VM_PROT_EXECUTE) == 0);
|
||||
|
||||
sys_icache_invalidate((void*)page, 0x4000);
|
||||
|
||||
dprintf("patched checkra1n\n");
|
||||
}
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,74 @@
|
||||
#include <stdio.h>
|
||||
#include <assert.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
#include <mach/mach.h>
|
||||
#include <mach/error.h>
|
||||
#include <mach/vm_prot.h>
|
||||
#include <libkern/OSCacheControl.h>
|
||||
#include "phookra1n.h"
|
||||
|
||||
#if defined(__x86_64__)
|
||||
// A8
|
||||
const char lea_rsi_0x100021060[] = {0x48, 0x8d, 0x35, 0x51, 0xdb, 0x00, 0x00};
|
||||
|
||||
// A10x
|
||||
const char lea_rsi_0x100025220[] = {0x48, 0x8d, 0x35, 0x2a, 0x1d, 0x01, 0x00};
|
||||
|
||||
// T2
|
||||
const char lea_rsi_0x100026c50[] = {0x48, 0x8d, 0x35, 0xbe, 0x37, 0x01, 0x00};
|
||||
|
||||
static void patch(char *stream, const uint8_t *payload, const uint32_t payload_len)
|
||||
{
|
||||
char *s = stream;
|
||||
|
||||
uint64_t from = (uint64_t)stream;
|
||||
uint64_t to = (uint64_t)payload;
|
||||
|
||||
uint32_t lea_off = to - from - 7;
|
||||
dprintf("from 0x%llx to 0x%llx 0x%llx size 0x%x\n", from, to, from + lea_off + 7, payload_len);
|
||||
|
||||
void *lea_imm32 = stream + 3;
|
||||
void *mov1_imm32 = stream + 8;
|
||||
void *mov2_imm32 = stream + 19;
|
||||
|
||||
memcpy(lea_imm32, &lea_off, sizeof(uint32_t));
|
||||
memcpy(mov1_imm32, &payload_len, sizeof(uint32_t));
|
||||
memcpy(mov2_imm32, &payload_len, sizeof(uint32_t));
|
||||
|
||||
dprintf("patched: lea=%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx, mov1=%02hhx%02hhx%02hhx%02hhx%02hhx, mov2=%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx\n",
|
||||
s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7], s[8], s[9], s[10],
|
||||
s[11], s[17], s[18], s[19], s[20], s[21], s[22]);
|
||||
}
|
||||
|
||||
void setup_hooks_x86_64(void *stream)
|
||||
{
|
||||
void
|
||||
*t8011_patch_base = (void*)((char*)stream + 0x134EF),
|
||||
*t7000_patch_base = (void*)((char*)stream + 0x13508),
|
||||
*t8012_patch_base = (void*)((char*)stream + 0x1348B);
|
||||
|
||||
vm_address_t page = (vm_address_t)((char*)stream + 0x13000);
|
||||
|
||||
assert(memcmp(t7000_patch_base, lea_rsi_0x100021060, sizeof(lea_rsi_0x100021060)) == 0);
|
||||
assert(memcmp(t8011_patch_base, lea_rsi_0x100025220, sizeof(lea_rsi_0x100025220)) == 0);
|
||||
assert(memcmp(t8012_patch_base, lea_rsi_0x100026c50, sizeof(lea_rsi_0x100026c50)) == 0);
|
||||
|
||||
assert(vm_protect(mach_task_self(), page, 0x1000, false, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY) == 0);
|
||||
|
||||
uint32_t t7000_shared_len = 0xaa4; // shared with T7001
|
||||
if (t7000_bin_len > t7000_shared_len)
|
||||
t7000_shared_len = t7000_bin_len;
|
||||
|
||||
patch(t7000_patch_base, t7000_bin, t7000_shared_len);
|
||||
patch(t8011_patch_base, t8011_bin, t8011_bin_len);
|
||||
patch(t8012_patch_base, t8012_bin, t8012_bin_len);
|
||||
|
||||
assert(vm_protect(mach_task_self(), page, 0x1000, false, VM_PROT_READ | VM_PROT_EXECUTE) == 0);
|
||||
|
||||
sys_icache_invalidate((void*)page, 0x1000);
|
||||
|
||||
dprintf("patched checkra1n\n");
|
||||
}
|
||||
#endif
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,28 @@
|
||||
#ifndef PALERA1N_CHECKRA1N_HELPER_H
|
||||
#define PALERA1N_CHECKRA1N_HELPER_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
|
||||
#ifdef DEV_BUILD
|
||||
#define dprintf(...) printf(__VA_ARGS__)
|
||||
#else
|
||||
#define dprintf(...)
|
||||
#endif
|
||||
|
||||
extern uint8_t t7000_bin[];
|
||||
extern uint32_t t7000_bin_len;
|
||||
|
||||
extern uint8_t t8011_bin[];
|
||||
extern uint32_t t8011_bin_len;
|
||||
|
||||
extern uint8_t t8012_bin[];
|
||||
extern uint32_t t8012_bin_len;
|
||||
|
||||
#if defined(__x86_64__)
|
||||
void setup_hooks_x86_64(void *stream);
|
||||
#elif defined(__arm64__)
|
||||
void setup_hooks_arm64(void *stream);
|
||||
#endif
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,32 @@
|
||||
C_SRC = $(wildcard *.c)
|
||||
C_OBJS = $(patsubst %,$(OBJDIR)/%,$(C_SRC:.c=.c.o))
|
||||
|
||||
PWD != pwd
|
||||
|
||||
OBJDIR = $(PWD)/obj
|
||||
GENDIR = $(PWD)/gen
|
||||
|
||||
C_OBJS += $(GENDIR)/gen-payload-t7000.c.o $(GENDIR)/gen-payload-t8011.c.o $(GENDIR)/gen-payload-t8012.c.o
|
||||
|
||||
all: dirs checkra1npatcher
|
||||
|
||||
dirs:
|
||||
mkdir -p $(OBJDIR) $(GENDIR)
|
||||
|
||||
$(OBJDIR)/%.c.o: %.c
|
||||
$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c -o $@ $<
|
||||
|
||||
checkra1npatcher: $(C_OBJS) $(wildcard *.h)
|
||||
$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(C_OBJS) $(S_OBJS) -o $@
|
||||
|
||||
$(GENDIR)/gen-payload-%.c: payloads/%.bin
|
||||
echo '#include <stdint.h>' > $@
|
||||
cd payloads && xxd -iC $$(echo $< | cut -d/ -f2) | sed -e 's/unsigned int/uint32_t/' -e 's/unsigned char/uint8_t/' >> $@
|
||||
|
||||
$(GENDIR)/gen-payload-%.c.o: $(GENDIR)/gen-payload-%.c
|
||||
$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c -o $@ $<
|
||||
|
||||
clean:
|
||||
rm -f $(OBJDIR)/*.o $(GENDIR)/*.*
|
||||
|
||||
.PHONY: dirs
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,436 @@
|
||||
#if __has_include(<elf.h>)
|
||||
#include <elf.h>
|
||||
#else
|
||||
#include "counterfeit_elf.h"
|
||||
#endif
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <inttypes.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <sys/mman.h>
|
||||
#include <sys/stat.h>
|
||||
#include <unistd.h>
|
||||
|
||||
extern uint8_t t7000_bin[];
|
||||
extern uint32_t t7000_bin_len;
|
||||
|
||||
extern uint8_t t8011_bin[];
|
||||
extern uint32_t t8011_bin_len;
|
||||
|
||||
extern uint8_t t8012_bin[];
|
||||
extern uint32_t t8012_bin_len;
|
||||
|
||||
#define elf_assert(cond) \
|
||||
do { \
|
||||
if (!(cond)) { \
|
||||
fprintf(stderr, "Unsupported ELF file: %s:%d\n", __FILE__, __LINE__); \
|
||||
return -1; \
|
||||
} \
|
||||
} while (0)
|
||||
|
||||
const uint8_t elf_header[] = {0x7f, 'E', 'L', 'F'};
|
||||
|
||||
// elf64_ptr_to_va
|
||||
// elf_va_to_ptr
|
||||
|
||||
bool elf_check(const void *elf) {
|
||||
const Elf64_Ehdr *hdr = elf;
|
||||
if (memcmp(hdr->e_ident, elf_header, 4) != 0) {
|
||||
fprintf(stderr, "Invalid ELF\n");
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
Elf64_Addr elf64_ptr_to_va(const void *elf, const void *p) {
|
||||
if (!elf_check(elf))
|
||||
return -1;
|
||||
|
||||
const Elf64_Ehdr *hdr = elf;
|
||||
|
||||
Elf64_Off off = (Elf64_Off)((uint8_t *)p - (uint8_t *)elf);
|
||||
|
||||
Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)elf + hdr->e_shoff);
|
||||
|
||||
for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
|
||||
if (sections[i].sh_type == SHT_NOBITS)
|
||||
continue;
|
||||
if (off >= sections[i].sh_offset &&
|
||||
off < (sections[i].sh_offset + sections[i].sh_size)) {
|
||||
Elf64_Off section_off = off - sections[i].sh_offset;
|
||||
if (!sections[i].sh_addr)
|
||||
return 0;
|
||||
|
||||
return sections[i].sh_addr + section_off;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
Elf32_Addr elf32_ptr_to_va(const void *elf, const void *p) {
|
||||
if (!elf_check(elf))
|
||||
return -1;
|
||||
|
||||
const Elf32_Ehdr *hdr = elf;
|
||||
|
||||
Elf32_Off off = (Elf32_Off)((uint8_t *)p - (uint8_t *)elf);
|
||||
|
||||
Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)elf + hdr->e_shoff);
|
||||
|
||||
for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
|
||||
if (sections[i].sh_type == SHT_NOBITS)
|
||||
continue;
|
||||
if (off >= sections[i].sh_offset &&
|
||||
off < (sections[i].sh_offset + sections[i].sh_size)) {
|
||||
Elf32_Off section_off = off - sections[i].sh_offset;
|
||||
if (!sections[i].sh_addr)
|
||||
return 0;
|
||||
|
||||
return sections[i].sh_addr + section_off;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void patch_arm64(void *elf, uint32_t *stream, const uint8_t *payload,
|
||||
const uint32_t payload_len) {
|
||||
int64_t from = elf64_ptr_to_va(elf, stream);
|
||||
int64_t to = elf64_ptr_to_va(elf, payload);
|
||||
|
||||
printf("from %" PRIx64 " to %" PRIx64 " size %" PRId32 "\n", from, to,
|
||||
payload_len);
|
||||
|
||||
int64_t diff = to - from;
|
||||
|
||||
// printf("diff: %" PRIx64 "\n", diff);
|
||||
|
||||
if (diff > 0xfffff || diff < -0xfffff) {
|
||||
fprintf(stderr, "%s: diff too large 0x%" PRIx64 " -> 0x%" PRIx64 "\n",
|
||||
__func__, from, to);
|
||||
return;
|
||||
}
|
||||
|
||||
int32_t immlo = diff & 0x3;
|
||||
int32_t immhi = (diff >> 2) & 0x7ffff;
|
||||
|
||||
uint8_t adr_reg = stream[0] & 0x1f;
|
||||
uint8_t mov1_reg = stream[1] & 0x1f;
|
||||
uint8_t mov2_reg = stream[2] & 0x1f;
|
||||
|
||||
stream[0] = 0x10000000 | (immlo << 29) | (immhi << 5) | adr_reg;
|
||||
stream[1] = 0x52800000 | mov1_reg | ((payload_len & 0xffff) << 5);
|
||||
stream[2] = 0x52800000 | mov2_reg | ((payload_len & 0xffff) << 5);
|
||||
|
||||
printf("patched: 0x%x 0x%x 0x%x\n", stream[0], stream[1], stream[2]);
|
||||
}
|
||||
|
||||
const uint8_t linux_x86_64_t7000_inst[] = {0x41, 0xbd, 0xa4, 0x0a, 0x00, 0x00,
|
||||
0xbe, 0x20, 0x54, 0x20, 0x00, 0xba,
|
||||
0xa4, 0x0a, 0x00, 0x00};
|
||||
const uint8_t linux_x86_64_t8011_inst[] = {0x41, 0xbd, 0xf4, 0x0c, 0x00, 0x00,
|
||||
0xbe, 0xe0, 0x95, 0x20, 0x00, 0xba,
|
||||
0xf4, 0x0c, 0x00, 0x00};
|
||||
const uint8_t linux_x86_64_t8012_inst[] = {0x41, 0xbd, 0xb8, 0x0a, 0x00, 0x00,
|
||||
0xbe, 0x10, 0xb0, 0x20, 0x00, 0xba,
|
||||
0xb8, 0x0a, 0x00, 0x00};
|
||||
|
||||
static int patch_x86_64(void *elf, uint8_t *stream, const uint8_t *payload,
|
||||
const uint32_t payload_len) {
|
||||
|
||||
Elf64_Addr payload_to = elf64_ptr_to_va(elf, payload);
|
||||
elf_assert(payload_to < UINT32_MAX);
|
||||
uint32_t payload_to32 = payload_to;
|
||||
|
||||
memcpy(stream + 2, &payload_len, 4);
|
||||
memcpy(stream + 7, &payload_to32, 4);
|
||||
memcpy(stream + 12, &payload_len, 4);
|
||||
|
||||
printf("patched: 0x%" PRIx64 " 0x%" PRIx64 "\n", elf64_ptr_to_va(elf, stream),
|
||||
payload_to);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int parse_checkra1n64(void *c1) {
|
||||
Elf64_Ehdr *hdr = c1;
|
||||
|
||||
elf_assert(hdr->e_shnum != 0);
|
||||
elf_assert(hdr->e_shstrndx != SHN_UNDEF);
|
||||
|
||||
Elf64_Shdr *sections = (Elf64_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
|
||||
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
|
||||
|
||||
Elf64_Half text_idx = 0, kpf_idx = 0;
|
||||
|
||||
for (Elf64_Half i = 0; i < hdr->e_shnum; i++) {
|
||||
if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
|
||||
text_idx = i;
|
||||
if (strcmp(&strings[sections[i].sh_name], ".const_kpf") == 0)
|
||||
kpf_idx = i;
|
||||
}
|
||||
elf_assert(text_idx);
|
||||
elf_assert(kpf_idx);
|
||||
elf_assert(sections[text_idx].sh_type == SHT_PROGBITS);
|
||||
elf_assert(sections[kpf_idx].sh_type == SHT_PROGBITS);
|
||||
elf_assert(sections[text_idx].sh_offset);
|
||||
elf_assert(sections[kpf_idx].sh_offset);
|
||||
elf_assert(sections[text_idx].sh_addr);
|
||||
elf_assert(sections[kpf_idx].sh_addr);
|
||||
|
||||
void *t7000_dst = (uint8_t *)c1 + 0x100 + sections[kpf_idx].sh_offset;
|
||||
|
||||
memcpy(t7000_dst, t7000_bin, t7000_bin_len);
|
||||
|
||||
void *t8011_dst = (uint8_t *)t7000_dst + t7000_bin_len;
|
||||
|
||||
memcpy(t8011_dst, t8011_bin, t8011_bin_len);
|
||||
|
||||
void *t8012_dst = (uint8_t *)t8011_dst + t8011_bin_len;
|
||||
|
||||
memcpy(t8012_dst, t8012_bin, t8012_bin_len);
|
||||
|
||||
uint8_t *stream = (uint8_t *)c1 + sections[text_idx].sh_offset;
|
||||
|
||||
uint32_t t7000_shared_len = 0xaa4; // shared with T7001
|
||||
if (t7000_bin_len > t7000_shared_len)
|
||||
t7000_shared_len = t7000_bin_len;
|
||||
|
||||
if (hdr->e_machine == EM_AARCH64) {
|
||||
uint32_t *t8011_patch_base = (uint32_t *)(stream + 0x53fc),
|
||||
*t7000_patch_base = (uint32_t *)(stream + 0x5410),
|
||||
*t8012_patch_base = (uint32_t *)(stream + 0x53ac);
|
||||
|
||||
elf_assert(t8011_patch_base[0] == 0x10c5c621);
|
||||
elf_assert(t8012_patch_base[0] == 0x10c69961);
|
||||
elf_assert(t7000_patch_base[0] == 0x10c3b861);
|
||||
|
||||
patch_arm64(c1, t8011_patch_base, t8011_dst, t8011_bin_len);
|
||||
patch_arm64(c1, t8012_patch_base, t8012_dst, t8012_bin_len);
|
||||
patch_arm64(c1, t7000_patch_base, t7000_dst, t7000_shared_len);
|
||||
} else if (hdr->e_machine == EM_X86_64) {
|
||||
uint8_t *t8011_patch_base = stream + 0x3fe9,
|
||||
*t7000_patch_base = stream + 0x3ffb,
|
||||
*t8012_patch_base = stream + 0x3fa1;
|
||||
|
||||
elf_assert(memcmp(t8011_patch_base, linux_x86_64_t8011_inst,
|
||||
sizeof(linux_x86_64_t8011_inst)) == 0);
|
||||
elf_assert(memcmp(t7000_patch_base, linux_x86_64_t7000_inst,
|
||||
sizeof(linux_x86_64_t7000_inst)) == 0);
|
||||
elf_assert(memcmp(t8012_patch_base, linux_x86_64_t8012_inst,
|
||||
sizeof(linux_x86_64_t8012_inst)) == 0);
|
||||
|
||||
elf_assert(patch_x86_64(c1, t8011_patch_base, t8011_dst, t8011_bin_len) ==
|
||||
0);
|
||||
elf_assert(patch_x86_64(c1, t8012_patch_base, t8012_dst, t8012_bin_len) ==
|
||||
0);
|
||||
elf_assert(
|
||||
patch_x86_64(c1, t7000_patch_base, t7000_dst, t7000_shared_len) == 0);
|
||||
} else {
|
||||
elf_assert(0);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int patch_i486(void *elf, uint8_t *stream, const uint8_t *payload,
|
||||
const uint32_t payload_len) {
|
||||
Elf32_Addr payload_to = elf32_ptr_to_va(elf, payload);
|
||||
|
||||
elf_assert(stream[0] == 0x68);
|
||||
elf_assert(stream[5] == 0x68);
|
||||
elf_assert(stream[19] == 0xbf);
|
||||
|
||||
memcpy(stream + 1, &payload_len, 4);
|
||||
memcpy(stream + 6, &payload_to, 4);
|
||||
memcpy(stream + 20, &payload_len, 4);
|
||||
|
||||
printf("patched: 0x%" PRIx32 " 0x%" PRIx32 " 0x%" PRIx32 "\n", elf32_ptr_to_va(elf, stream),
|
||||
payload_to, payload_len);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int parse_checkra1n32(void *c1) {
|
||||
Elf32_Ehdr *hdr = c1;
|
||||
|
||||
elf_assert(hdr->e_shnum != 0);
|
||||
elf_assert(hdr->e_shstrndx != SHN_UNDEF);
|
||||
|
||||
Elf32_Shdr *sections = (Elf32_Shdr *)((uint8_t *)c1 + hdr->e_shoff);
|
||||
char *strings = (char *)c1 + sections[hdr->e_shstrndx].sh_offset;
|
||||
|
||||
Elf32_Half text_idx = 0, kpf_idx = 0;
|
||||
|
||||
for (Elf32_Half i = 0; i < hdr->e_shnum; i++) {
|
||||
if (strcmp(&strings[sections[i].sh_name], ".text") == 0)
|
||||
text_idx = i;
|
||||
if (strcmp(&strings[sections[i].sh_name], ".const_kpf") == 0)
|
||||
kpf_idx = i;
|
||||
}
|
||||
|
||||
elf_assert(text_idx);
|
||||
elf_assert(kpf_idx);
|
||||
elf_assert(sections[text_idx].sh_type == SHT_PROGBITS);
|
||||
elf_assert(sections[kpf_idx].sh_type == SHT_PROGBITS);
|
||||
elf_assert(sections[text_idx].sh_offset);
|
||||
elf_assert(sections[kpf_idx].sh_offset);
|
||||
elf_assert(sections[text_idx].sh_addr);
|
||||
elf_assert(sections[kpf_idx].sh_addr);
|
||||
|
||||
void *t7000_dst = (uint8_t *)c1 + 0x100 + sections[kpf_idx].sh_offset;
|
||||
|
||||
memcpy(t7000_dst, t7000_bin, t7000_bin_len);
|
||||
|
||||
void *t8011_dst = (uint8_t *)t7000_dst + t7000_bin_len;
|
||||
|
||||
memcpy(t8011_dst, t8011_bin, t8011_bin_len);
|
||||
|
||||
void *t8012_dst = (uint8_t *)t8011_dst + t8011_bin_len;
|
||||
|
||||
memcpy(t8012_dst, t8012_bin, t8012_bin_len);
|
||||
|
||||
uint8_t *stream = (uint8_t *)c1 + sections[text_idx].sh_offset;
|
||||
|
||||
if (hdr->e_machine == EM_ARM) {
|
||||
elf_assert(*(uint32_t *)(stream + 0x6024) == 0x13050); // T7000
|
||||
elf_assert(*(uint32_t *)(stream + 0x600c) == 0x17200); // T8011
|
||||
elf_assert(*(uint32_t *)(stream + 0x6008) == 0x18c20); // T8012
|
||||
|
||||
*(uint32_t *)(stream + 0x6024) = elf32_ptr_to_va(c1, t7000_dst);
|
||||
*(uint32_t *)(stream + 0x600c) = elf32_ptr_to_va(c1, t8011_dst);
|
||||
*(uint32_t *)(stream + 0x6008) = elf32_ptr_to_va(c1, t8012_dst);
|
||||
|
||||
const uint16_t orr_rN_rN_0x_M00[] = {
|
||||
0x0000, 0x0c01, 0x0c02, 0x0c03, 0x0b01, 0x0c05, 0x0c06, 0x0c07,
|
||||
0x0b02, 0x0c09, 0x0c0a, 0x0c0b, 0x0b03, 0x0c0d, 0x0c0e, 0x0c0f};
|
||||
|
||||
elf_assert(t7000_bin_len < 0xfff);
|
||||
elf_assert(t8011_bin_len < 0xfff);
|
||||
elf_assert(t8012_bin_len < 0xfff);
|
||||
|
||||
// T8011
|
||||
|
||||
uint8_t mov_reg = (*(uint32_t *)(stream + 0x5988) >> 12) & 0xf;
|
||||
uint8_t orr_reg = (*(uint32_t *)(stream + 0x5990) >> 12) & 0xf;
|
||||
|
||||
*(uint32_t *)(stream + 0x5988) =
|
||||
0xe3a00000 | mov_reg << 12 | (t8011_bin_len & 0xff);
|
||||
*(uint32_t *)(stream + 0x5990) = 0xe3800000 |
|
||||
orr_rN_rN_0x_M00[t8011_bin_len >> 8] |
|
||||
orr_reg << 12 | orr_reg << 16;
|
||||
|
||||
// T8012, T7000 and T7001 length is shared
|
||||
uint16_t shared_length = 0xaa4; // T7001
|
||||
if (t8012_bin_len > shared_length && t8012_bin_len > t7000_bin_len)
|
||||
shared_length = t8012_bin_len;
|
||||
|
||||
if (t7000_bin_len > shared_length && t7000_bin_len > t8012_bin_len)
|
||||
shared_length = t7000_bin_len;
|
||||
|
||||
elf_assert(shared_length >= 0x8a4);
|
||||
elf_assert(shared_length >= t8012_bin_len);
|
||||
elf_assert(shared_length >= t7000_bin_len);
|
||||
|
||||
*(uint32_t *)(stream + 0x59a0) =
|
||||
0xe3a00000 | mov_reg << 12 | (shared_length & 0xff);
|
||||
*(uint32_t *)(stream + 0x5950) =
|
||||
0xe3a00000 | mov_reg << 12 | (shared_length & 0xff);
|
||||
*(uint32_t *)(stream + 0x59a4) = 0xe3800000 |
|
||||
orr_rN_rN_0x_M00[t8011_bin_len >> 8] |
|
||||
orr_reg << 12 | orr_reg << 16;
|
||||
|
||||
printf("patched: 0x%" PRIx32 " mov reg %d\n",
|
||||
elf32_ptr_to_va(c1, stream + 0x5950), mov_reg);
|
||||
|
||||
} else if (hdr->e_machine == EM_386) {
|
||||
uint8_t *t7000_patch_base = (stream + 0x4f0f),
|
||||
*t8011_patch_base = (stream + 0x4def),
|
||||
*t8012_patch_base = (stream + 0x4d6f);
|
||||
|
||||
uint32_t t7000_shared_len = 0xaa4; // shared with T7001
|
||||
if (t7000_bin_len > t7000_shared_len)
|
||||
t7000_shared_len = t7000_bin_len;
|
||||
elf_assert(patch_i486(c1, t7000_patch_base, t7000_dst, t7000_shared_len) ==
|
||||
0);
|
||||
elf_assert(patch_i486(c1, t8011_patch_base, t8011_dst, t8011_bin_len) ==
|
||||
0);
|
||||
elf_assert(patch_i486(c1, t8012_patch_base, t8012_dst, t8012_bin_len) ==
|
||||
0);
|
||||
} else {
|
||||
elf_assert(0);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
int parse_checkra1n(void *c1) {
|
||||
if (!elf_check(c1))
|
||||
return -1;
|
||||
|
||||
if (*((uint8_t *)c1 + EI_CLASS) == ELFCLASS32) {
|
||||
return parse_checkra1n32(c1);
|
||||
} else if (*((uint8_t *)c1 + EI_CLASS) == ELFCLASS64) {
|
||||
return parse_checkra1n64(c1);
|
||||
} else {
|
||||
elf_assert(0);
|
||||
}
|
||||
}
|
||||
|
||||
int main(int argc, const char *argv[]) {
|
||||
int retval = -1;
|
||||
|
||||
if (argc < 3) {
|
||||
fprintf(stderr, "Usage: %s <checkra1n file> <out checkra1n>\n", argv[0]);
|
||||
return -1;
|
||||
}
|
||||
|
||||
int fd = open(argv[1], O_RDWR);
|
||||
if (fd == -1) {
|
||||
fprintf(stderr, "Could not open %s: %d (%s)\n", argv[1], errno,
|
||||
strerror(errno));
|
||||
return -1;
|
||||
}
|
||||
|
||||
off_t size = lseek(fd, 0, SEEK_END);
|
||||
|
||||
if (size == -1) {
|
||||
fprintf(stderr, "Could not seek checkra1n: %d (%s)\n", errno,
|
||||
strerror(errno));
|
||||
goto out_close_fd;
|
||||
}
|
||||
|
||||
void *c1 =
|
||||
mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_FILE | MAP_PRIVATE, fd, 0);
|
||||
if (c1 == MAP_FAILED) {
|
||||
fprintf(stderr, "Could not map checkra1n: %d (%s)\n", errno,
|
||||
strerror(errno));
|
||||
goto out_close_fd;
|
||||
}
|
||||
|
||||
parse_checkra1n(c1);
|
||||
|
||||
int out_fd = open(argv[2], O_CREAT | O_WRONLY, 0755);
|
||||
if (out_fd == -1) {
|
||||
fprintf(stderr, "Could not open %s: %d (%s)\n", argv[2], errno,
|
||||
strerror(errno));
|
||||
goto out_munmap;
|
||||
}
|
||||
|
||||
ssize_t wrote = write(out_fd, c1, size);
|
||||
if (wrote != size) {
|
||||
fprintf(stderr, "Could not write %s: %d (%s)\n", argv[2], errno,
|
||||
strerror(errno));
|
||||
goto out_close_out_fd;
|
||||
}
|
||||
|
||||
retval = 0;
|
||||
out_close_out_fd:
|
||||
close(out_fd);
|
||||
out_munmap:
|
||||
munmap(c1, size);
|
||||
out_close_fd:
|
||||
close(fd);
|
||||
return retval;
|
||||
}
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../helper/payloads
|
||||
Reference in new issue
Block a user