Skip to content

Instantly share code, notes, and snippets.

@Proteas
Proteas / xnu-4570.1.46-arm64-steps.txt
Created Oct 9, 2017
steps to build arm64 version of xnu-4570.1.46
View xnu-4570.1.46-arm64-steps.txt
Following are my steps to build the ARM64 version of xnu-4570.1.46, hope this is helpfull for saving time.
1. Use Xcode 9.0
2. Preparation is same as macOS, and there is a guide: https://0xcc.re/building-xnu-kernel-macosx-sierrra-10-12-x/
3. There is an ARM64 version libfirehose: https://github.com/Proteas/install_firehose_lib
4. Copy and edit the ARM64 config(CFLAGS, LDFLAGS) from darwin-on-arm/xnu to your target project
5. Example CFLAGS: -Darm64 -DARM64 -D__arm64__ -D__ARM64__ -DLP64 -DCONFIG_EMBEDDED -mkernel -DARM64_BOARD_CONFIG_T8011=1
6. Fix compiling stage errors by directly importing the missing headers or editing the code
7. Fix linking stage errors by implementing place holder funcitons for: chudxnu_cpu_alloc, etc
8. If missing symbol __divti3 in linking stage, get the runtime from llvm.
@Proteas
Proteas / dyld-actions-during-loading.txt
Created Jul 13, 2017
actions of dyld when loading /bin/ls
View dyld-actions-during-loading.txt
======== dyld by Proteas ========
seg name: __PAGEZERO
seg name: __TEXT
seg name: __DATA
seg name: __LINKEDIT
ImageLoader=72, ImageLoaderMachO=120, ImageLoaderMachOClassic=144, ImageLoaderMachOCompressed=128
notifySingle(state=10, image=/bin/ls)
addMappedRange(0x100000000->0x10000A000) for ls
sSharedCacheSlide=0x57333000, loadedAddress=0x7fffc7333000, preferedLoadAddress=0x7fff70000000
addRootImage(0x7fdce1f01eb0, /bin/ls)
View macos-kern-info.d
#! /usr/sbin/dtrace -C -s
/*
requirement: disable SIP
*/
#pragma D option quiet
BEGIN {
printf("vm_kernel_slide: 0x%p\n", (`vm_kernel_slide));
printf("vm_kernel_base: 0x%p\n", (`vm_kernel_base));
View o_direct_race.c
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/syscall.h>
View dtrace-sample.d
#!/usr/sbin/dtrace -s
#pragma D option flowindent
/* monitor file open */
syscall::open:entry
{
printf("%s %s", execname, copyinstr(arg0));
}
@Proteas
Proteas / Makefile
Created Oct 31, 2014
A Guide to Kernel Exploitation - Chapter 4 - Solaris - Heap Overflow - Tested on OpenSolaris-0906
View Makefile
all: driver exp
driver: dummymod.c
cc -D_KERNEL -m64 -xmodel=kernel -c dummymod.c
/usr/bin/ld -r -o dummy dummymod.o
exp:
cc -o hexp hexpl.c -lsched -m64 -lkstat
View gdbGetStrippedSymbols.sh
#!/bin/sh
# gdbGetStrippedSymbols.sh
# @author Dominik Hadl (@dominikhadl)
# @description This script automates the setup of gdb on a stripped applicaiton adds symbols. It uses objc-symbols to get the symbols,
# then SymTabCreator and finally creates a command that is automatically loaded into gdb on start.
# @license Licensed under WTFPL license (see http://www.wtfpl.net/txt/copying/ for full license).
# @dependencies
# 1. objc-symbols
# 2. SymTabCreator
# 3. gdb (really non-obvious)
View DCrypt-Proteas.sh
#!/bin/sh
#
# DeCrypt - v1.2 (2013-02-05)
# - v1.1 (2008-10-21)
# - v1.2 (2013-02-05)
# FloydianSlip, Proteas
#
# Heavily based on xcrack
#