saagarjha

#!/bin/sh

set -eu

create_iconset() {
	mkdir -p Ghidra.iconset
	cat << EOF > Ghidra.iconset/Contents.json
{
	"images":
	[

saagarjha

// To compile: clang++ -arch x86_64 -arch arm64 -std=c++20 library_injector.cpp -lbsm -lEndpointSecurity -o library_injector,
// then codesign with com.apple.developer.endpoint-security.client and run the
// program as root.

#include <EndpointSecurity/EndpointSecurity.h>
#include <algorithm>
#include <array>
#include <bsm/libbsm.h>
#include <cstdint>
#include <cstdlib>

saagarjha

{
  "internal" => 0
  "name" => "a14"
  "system" => {
    "cpu" => {
      "aliases" => {
        "Cycles" => "FIXED_CYCLES"
        "Instructions" => "FIXED_INSTRUCTIONS"
      }
      "architecture" => "arm64"

saagarjha

// clang path_hook.mm -shared -ldl -g -framework Foundation path_hook.o -L/usr/lib/swift

#include <cassert>
#include <cstdint>
#include <dlfcn.h>
#include <mach/arm/vm_param.h>
#include <mach/kern_return.h>
#include <mach/mach_init.h>
#include <mach/vm_map.h>
#include <mach/vm_prot.h>

saagarjha

// https://gist.github.com/saagarjha/ed701e3369639410b5d5303612964557
#import "swizzler.h"
#import <Foundation/Foundation.h>
#import <cstddef>
#import <cstdlib>
#import <dlfcn.h>
#import <mach-o/dyld.h>
#import <mutex>
#import <string>
#import <tuple>

saagarjha

// Example usage:
// Swizzler<NSString *, NSDateFormatter *, NSDate *> NSDateFormatter_stringFromDate_ {
//     NSDateFormatter.class, @selector(stringFromDate:), [&](auto self, auto date) {
//         if ([NSCalendar.currentCalendar components:NSCalendarUnitWeekday fromDate:date].weekday == 4) {
//             return @"It Is Wednesday My Dudes";
//         } else {
//             return NSDateFormatter_stringFromDate_(self, date);
//         }
//     }
// };

saagarjha

// Sometimes you have a large file on a small disk and would like to "transform"
// it in some way: for example, by decompressing it. However, you might not have
// enough space on disk to keep both the the compressed file and the
// decompressed results. If the process can be done in a streaming fashion, it
// would be nice if the file could be "drained"; that is, the file would be
// sequentially deleted as it is consumed. At the start you'd have 100% of the
// original file, somewhere in the middle you'd have about half of the original
// file and half of your output, and by the end the original file will be gone
// and you'll be left with just the results. If you do it this way, you might
// be able to do the entire operation without extra space!

saagarjha

// Usage should be fairly self-explanatory, just paste this in a header and use
// CRASH_WITH_MESSAGE("foobar") in your function.
// Example backtrace:
// Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
// 0   ???                           	       0x1022d8000 CRASHING IN test.c:20 (foobar) + 0
// 1   a.out                         	       0x1022d7f60 main + 24
// 2   dyld                          	       0x195f07e50 start + 2544

#define STRINGIFY(a) #a
#define CRASH_FUNCTION_NAME(file, line, message) "CRASHING IN " file ":" STRINGIFY(line) " (" message ")"

saagarjha

for function in filter(lambda f: f.name == "_objc_msgSend", bv.functions):
	selector = function.lowest_address + 4
	selector = list(bv.get_code_refs_from(selector))[0]
	selector = list(bv.get_data_refs(selector))[0]
	selector = list(bv.get_data_refs_from(selector))[0]
	selector = bv.get_data_var_at(selector).value
	# objc_msgSend itself, probably
	if not selector:
		continue
	selector = selector[:-1].decode()

saagarjha

// As seen on:
// https://federated.saagarjha.com/notice/AaEMQpJBSbxhLyxYzg
// https://twitter.com/_saagarjha/status/1707423903969341949

// Compiling: gcc mmap_vs_read.c -O3 -o mmap_vs_read
// Usage: ./mmap_vs_read <bigfile> <mmap|read>

#include <fcntl.h>
#include <stddef.h>
#include <stdio.h>