Skip to content

Instantly share code, notes, and snippets.

@devbug
Forked from uroboro/offsets.c
Last active December 19, 2016 05:11
Show Gist options
  • Save devbug/cb698d1b3fd6ec666a1192552020b863 to your computer and use it in GitHub Desktop.
Save devbug/cb698d1b3fd6ec666a1192552020b863 to your computer and use it in GitHub Desktop.
Proper Indentation
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <sys/utsname.h>
#include "offsets.h"
// offsets from the main kernel 0xfeedfacf
uint64_t allproc_offset;
uint64_t kernproc_offset;
// offsets in struct proc
uint64_t struct_proc_p_pid_offset;
uint64_t struct_proc_task_offset;
uint64_t struct_proc_p_uthlist_offset;
uint64_t struct_proc_p_ucred_offset;
uint64_t struct_proc_p_comm_offset;
// offsets in struct kauth_cred
uint64_t struct_kauth_cred_cr_ref_offset;
// offsets in struct uthread
uint64_t struct_uthread_uu_ucred_offset;
uint64_t struct_uthread_uu_list_offset;
// offsets in struct task
uint64_t struct_task_ref_count_offset;
uint64_t struct_task_itk_space_offset;
// offsets in struct ipc_space
uint64_t struct_ipc_space_is_table_offset;
// offsets in struct ipc_port
uint64_t struct_ipc_port_ip_kobject_offset;
#pragma mark - arm64
void init_arm64_10_1_1() {
struct_proc_p_pid_offset = 0x10;
struct_proc_task_offset = 0x18;
struct_proc_p_uthlist_offset = 0x98;
struct_proc_p_ucred_offset = 0x100;
struct_proc_p_comm_offset = 0x26c;
struct_kauth_cred_cr_ref_offset = 0x10;
struct_uthread_uu_ucred_offset = 0x168;
struct_uthread_uu_list_offset = 0x170;
struct_task_ref_count_offset = 0x10;
struct_task_itk_space_offset = 0x300;
struct_ipc_space_is_table_offset = 0x20;
struct_ipc_port_ip_kobject_offset = 0x68;
}
#pragma mark - macOS
void init_macos_10_12_1() {
printf("setting offsets for MacOS 10.12.1\n");
allproc_offset = 0x8bb490;
kernproc_offset = 0x8BA7D8;
struct_proc_task_offset = 0x18;
struct_proc_p_uthlist_offset = 0x98;
struct_proc_p_ucred_offset = 0xe8;
struct_proc_p_comm_offset = 0x2e4;
struct_kauth_cred_cr_ref_offset = 0x10;
struct_uthread_uu_ucred_offset = 0x168;
struct_uthread_uu_list_offset = 0x170;
struct_task_ref_count_offset = 0x10;
struct_task_itk_space_offset = 0x300;
struct_ipc_space_is_table_offset = 0x18;
struct_ipc_port_ip_kobject_offset = 0x68;
}
#pragma mark - iOS
#define init_iOS_10_1_1_S5L8960X() { \
allproc_offset = 0x5a4128; \
kernproc_offset = 0x5aa0e0; \
}
#define init_iOS_10_1_1_T7000() { \
allproc_offset = 0x5b4168; \
kernproc_offset = 0x5ba0e0; \
}
#define init_iOS_10_1_1_T7001() { \
allproc_offset = 0x5b4228; \
kernproc_offset = 0x5ba0e0; \
}
#define init_iOS_10_1_1_S8000() { \
allproc_offset = 0x5a4148; \
kernproc_offset = 0x5aa0e0; \
}
#define init_iOS_10_1_1_T8010() { \
allproc_offset = 0x5ec178; \
kernproc_offset = 0x5f20e0; \
}
//here end
void unknown_build() {
printf("This is an unknown kernel build - the offsets are likely to be incorrect and it's very unlikely this exploit will work\n");
printf("You need to find these two kernel symbols:\n");
printf(" allproc\n");
printf(" kernproc\n\n");
printf("and update the code\n");
}
#pragma mark - init_offsets
void init_offsets() {
struct utsname u = { 0 };
int err = uname(&u);
if (err == -1) {
printf("uname failed - what platform is this?\n");
printf("there's no way this will work, but trying anyway!\n");
init_arm64_10_1_1();
init_iOS_10_1_1_S5L8960X();
return;
}
printf("sysname: %s\n", u.sysname);
printf("nodename: %s\n", u.nodename);
printf("release: %s\n", u.release);
printf("version: %s\n", u.version);
printf("machine: %s\n", u.machine);
#pragma mark - iDevice
# define check_iOS_AP(v, name) \
if (strstr(u.version, #name)) { \
printf("device %s matched\n", u.machine); \
init_iOS_ ## v ## name(); \
return; \
}
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64")) {
init_arm64_10_1_1();
check_iOS_AP(10_1_1, _S5L8960X);
check_iOS_AP(10_1_1, _T7000);
check_iOS_AP(10_1_1, _T7001);
check_iOS_AP(10_1_1, _S8000);
check_iOS_AP(10_1_1, _T8010);
}
printf("don't recognize this platform\n");
unknown_build();
init_arm64_10_1_1();
init_iOS_10_1_1_S5L8960X();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment