Skip to content

Instantly share code, notes, and snippets.

@jmpews
Created November 7, 2019 15:24
Show Gist options
  • Save jmpews/eba1ef7ed38500634634e08e41851c8e to your computer and use it in GitHub Desktop.
Save jmpews/eba1ef7ed38500634634e08e41851c8e to your computer and use it in GitHub Desktop.
reversing Sandbox kext

macOS Sandbox.kext

  if ( (unsigned int)do_profile_create(&platform_profile, &the_real_platform_profile_data, 0LL, 25978LL, 0LL) )
    panic(
      "\"failed to initialize platform sandbox\"@/BuildRoot/Library/Caches/com.apple.xbs/Sources/Sandbox_executables/Sand"
      "box-851.201.1/src/kext/kext.c:3434");
}
__const:000000000001E140 ; ===========================================================================
__const:000000000001E140
__const:000000000001E140 ; Segment type: Pure data
__const:000000000001E140 ; Segment permissions: Read/Execute
__const:000000000001E140 __const         segment para public 'DATA' use64
__const:000000000001E140                 assume cs:__const
__const:000000000001E140                 ;org 1E140h
__const:000000000001E140 ; char the_real_platform_profile_data[25978]
__const:000000000001E140 _the_real_platform_profile_data dw 0    ; DATA XREF: _string_is_mutable+E↑o
__const:000000000001E140                                         ; _hook_policy_init+34C↑o
__const:000000000001E142                 db  26h ; &
__const:000000000001E143                 db    5
__const:000000000001E144                 db  28h ; (
__const:000000000001E145                 db    5
__const:000000000001E146                 db  29h ; )
__const:000000000001E147                 db    5
__const:000000000001E148                 db    7
__const:000000000001E149                 db    0
__const:000000000001E14A                 db    1
__const:000000000001E14B                 db  1Eh
__const:000000000001E14C                 db  25h ; %
__const:000000000001E14D                 db    5
__const:000000000001E14E                 db  25h ; %
__const:000000000001E14F                 db    5
__const:000000000001E150                 db  25h ; %
__const:000000000001E151                 db    5
__const:000000000001E152                 db  23h ; #
__const:000000000001E153                 db    5
__const:000000000001E154                 db  25h ; %
__const:000000000001E155                 db    5
__const:000000000001E156                 db  25h ; %
__const:000000000001E157                 db    5
__const:000000000001E158                 db  25h ; %
__const:000000000001E159                 db    5
__const:000000000001E15A                 db  25h ; %
__const:000000000001E15B                 db    5
__const:000000000001E15C                 db  25h ; %
__const:000000000001E15D                 db    5
__const:000000000001E15E                 db  25h ; %
__const:000000000001E15F                 db    5
__const:000000000001E160                 db  87h
__const:000000000001E161                 db    4
__const:000000000001E162                 db  87h
__const:000000000001E163                 db    4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment