Skip to content

Instantly share code, notes, and snippets.

@mkYYY mkYYY/generate.py
Last active Jan 20, 2020

Embed
What would you like to do?
Python script to give function names for iOS kernelcaches on Radare2, by using Jtool2's companion file
#!/usr/bin/env python3
import sys
import re
def usage():
print("""usage: %s <kernelcache> <Jtool2's companion file> <R2 project name>
Companion file can be obtained as follows:
$ jtool2 --analyze <kernelcache>
""")
return
def gen(afs, binname, projname):
buf = """#!/usr/bin/env python3
\"\"\"
[!] C++ mangled symbols would be unchanged (for now)
Prior the execution, create the R2 project as follows:
$ r2 -AA <kernelcache>
[0xfffffff0...]> Ps <R2 project name>
Then close the R2 session.
Make sure that no R2 sessions are opening the project when you execute the script!
While R2 commands are executed, there would be warning messages:
\"Cannot find function at 0x...\"
Those are fine. They are just not addresses where the functions start, and no change
will take place for those addresses.
\"\"\"
import r2pipe
"""
buf += "r = r2pipe.open(\"%s\"" % binname
buf += ", flags=[\"-p%s\"])\n\n" % projname
for af in afs:
buf += "r.cmd(\"afn jtool2.%s @ %s\")\n" % (af[1], af[0])
if projname is not None:
buf += "\nr.cmd(\"Ps\")\n\n"
outname = "r2script.py"
with open(outname, "w") as f:
f.write(buf)
def main():
if len(sys.argv) < 4:
usage()
sys.exit(1)
kernelcache = sys.argv[1]
companion_file = sys.argv[2]
project = sys.argv[3]
pattern = "^0xf{7}0([0-9]|[a-f]){8}\|_(?!(_Z|func_|munger))"
addr_funs = list()
funcs = list()
with open(companion_file, "r") as f:
for line in f:
if re.match(pattern, line):
tup = tuple(line.split("|"))
if tup[2] == "\n":
addr_funs.append(tup)
funcs.append(tup[1])
for i in range(len(funcs)):
func = funcs.pop(0)
if func in funcs:
# Remove from addr_funs too
to_rm_idx = list()
for i in range(len(addr_funs)):
if addr_funs[i][1] == func:
to_rm_idx.append(i)
for idx in sorted(to_rm_idx, reverse=True):
del addr_funs[idx]
print("[+] Generate radare2 script to rename %d symbols" % len(addr_funs))
gen(addr_funs, kernelcache, project)
if __name__ == "__main__":
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.