Merge pull request #16 from Sticktron/develop

original reload behaviour; afps suid mount; some minor changes

g0blin/Info.plist

@@ -29,11 +29,13 @@
 		<string>armv7</string>
 	</array>
 	<key>UIStatusBarStyle</key>
-	<string>UIStatusBarStyleDefault</string>
+	<string>UIStatusBarStyleLightContent</string>
 	<key>UISupportedInterfaceOrientations</key>
 	<array>
 		<string>UIInterfaceOrientationPortrait</string>
 	</array>
+	<key>UIViewControllerBasedStatusBarAppearance</key>
+	<false/>
 	<key>UISupportedInterfaceOrientations~ipad</key>
 	<array>
 		<string>UIInterfaceOrientationPortrait</string>

g0blin/ViewController.m

@@ -33,6 +33,7 @@
 static task_t tfp0;
 static uint64_t kslide;
 static uint64_t kbase;
+static uint64_t kcred;
 
 
 @implementation ViewController
@@ -101,7 +102,7 @@ static uint64_t kbase;
     
     [self log:@"exploiting kernel"];
     
-    kern_return_t ret = v0rtex(&tfp0, &kslide);
+    kern_return_t ret = v0rtex(&tfp0, &kslide, &kcred);
     
     dispatch_async(dispatch_get_main_queue(), ^{
         
@@ -120,6 +121,8 @@ static uint64_t kbase;
         kbase = kslide + 0xFFFFFFF007004000;
         LOG("kern base -> 0x%llx", kbase);
         
+        LOG("kern cred -> 0x%llx", kcred);
+
         [self bypassKPP];
     });
 }
@@ -186,16 +189,18 @@ static uint64_t kbase;
     
     sleep(2);
     
-    // start launchdaemons ...    
+    // start launchdaemons ...
     LOG("reloading...");
     pid_t pid;
     posix_spawn(&pid, "/bin/launchctl", 0, 0, (char**)&(const char*[]){"/bin/launchctl", "load", "/Library/LaunchDaemons/0.reload.plist", NULL}, NULL);
-    waitpid(pid, 0, 0);
+//    waitpid(pid, 0, 0);
+    
+    sleep(2);
     
     // respring
-    LOG("respringing...");
-    pid_t pid2;
-    posix_spawn(&pid2, "/usr/bin/killall", 0, 0, (char**)&(const char*[]){"/usr/bin/killall", "-9", "SpringBoard", NULL}, NULL);
+//    LOG("respringing...");
+//    pid_t pid2;
+//    posix_spawn(&pid2, "/usr/bin/killall", 0, 0, (char**)&(const char*[]){"/usr/bin/killall", "-9", "SpringBoard", NULL}, NULL);
 }
 
 @end

g0blin/kpp.m

@@ -435,7 +435,7 @@ remappage[remapcnt++] = (x & (~PMK));\
 
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_file_check_mmap)), 0);
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_rename)), 0);
-        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_rename)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_rename)), 0); //2x
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_access)), 0);
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_chroot)), 0);
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_create)), 0);
@@ -455,7 +455,7 @@ remappage[remapcnt++] = (x & (~PMK));\
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setmode)), 0);
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setowner)), 0);
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setutimes)), 0);
-        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setutimes)), 0);
+        WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_setutimes)), 0); //2x
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_stat)), 0);
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_truncate)), 0);
         WriteAnywhere64(NewPointer(sbops+offsetof(struct mac_policy_ops, mpo_vnode_check_unlink)), 0);

g0blin/reload

@@ -1,9 +1,9 @@
 #!/bin/sh
 ls /etc/rc.d | while read a; do /etc/rc.d/$a; done
 sleep 1
-#launchctl unload $(ls /System/Library/LaunchDaemons/ | grep -v logd | grep -v fud | grep -v ReportCrash | while read a; do printf /System/Library/LaunchDaemons/$a\ ; done)
-#launchctl unload /System/Library/NanoLaunchDaemons
-#sleep 1
+launchctl unload $(ls /System/Library/LaunchDaemons/ | grep -v logd | grep -v fud | grep -v ReportCrash | while read a; do printf /System/Library/LaunchDaemons/$a\ ; done)
+launchctl unload /System/Library/NanoLaunchDaemons
+sleep 1
 launchctl load /Library/LaunchDaemons
 launchctl load /System/Library/LaunchDaemons
 launchctl load /System/Library/NanoLaunchDaemons

g0blin/remount.m

@@ -19,19 +19,27 @@
 
 kern_return_t do_remount(uint64_t slide) {
     
+    // feat. nosuid patch by coolstar
+    
     uint64_t _rootnode = OFFSET_ROOT_MOUNT_V_NODE + slide;
     uint64_t rootfs_vnode = rk64(_rootnode);
     
     // read flags
     uint64_t v_mount = rk64(rootfs_vnode + KSTRUCT_OFFSET_VNODE_V_UN);
-    uint32_t v_flag = rk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1);
+//    uint32_t v_flag = rk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1);
+    uint32_t v_flag = rk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG);
+    v_flag = v_flag & ~MNT_NOSUID;
+    v_flag = v_flag & ~MNT_RDONLY;
     
+
     // unset rootfs flag
-    wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1, v_flag & (~(0x1<<6)));
+//    wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1, v_flag & (~(0x1<<6)));
+    wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG, v_flag & ~MNT_ROOTFS);
     
     // remount
     char *nmz = strdup("/dev/disk0s1s1");
-    int lolr = mount("hfs", "/", MNT_UPDATE, (void *)&nmz);
+//    int lolr = mount("hfs", "/", MNT_UPDATE, (void *)&nmz);
+    int lolr = mount("apfs", "/", MNT_UPDATE, (void *)&nmz);
     if (lolr == -1) {
         LOG("ERROR: could not remount '/'");
         return KERN_FAILURE;
@@ -40,7 +48,8 @@ kern_return_t do_remount(uint64_t slide) {
     
     // set original flags back
     v_mount = rk64(rootfs_vnode + KSTRUCT_OFFSET_VNODE_V_UN);
-    wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1, v_flag);
-    
+//    wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG + 1, v_flag);
+    wk32(v_mount + KSTRUCT_OFFSET_MOUNT_MNT_FLAG, v_flag);
+
     return KERN_SUCCESS;
 }

g0blin/v0rtex.h

@@ -5,6 +5,7 @@
 #include "common.h"
 
 //kern_return_t v0rtex(task_t *tfp0, kptr_t *kslide, kptr_t *kernucred, kptr_t *selfproc);
-kern_return_t v0rtex(task_t *tfp0, uint64_t *kslide);
+kern_return_t v0rtex(task_t *tfp0, kptr_t *kslide, kptr_t *kernucred);
+//kern_return_t v0rtex(task_t *tfp0, uint64_t *kslide);
 
 #endif

g0blin/v0rtex.m

@@ -431,10 +431,10 @@ typedef union
     } b;
 } ktask_t;
 
-//kern_return_t v0rtex(task_t *tfp0, kptr_t *kslide, kptr_t *kernucred, kptr_t *selfproc)
-kern_return_t v0rtex(task_t *tfp0, uint64_t *kslide) {
-    kern_return_t retval = KERN_FAILURE,
-    ret;
+//kern_return_t v0rtex(task_t *tfp0, kptr_t *kslide, kptr_t *kernucred, kptr_t *selfproc) {
+//kern_return_t v0rtex(task_t *tfp0, uint64_t *kslide) {
+kern_return_t v0rtex(task_t *tfp0, kptr_t *kslide, kptr_t *kernucred) {
+    kern_return_t retval = KERN_FAILURE, ret;
     task_t self = mach_task_self();
     host_t host = mach_host_self();
     
@@ -1215,10 +1215,13 @@ zm_tmp < zm_hdr.start ? zm_tmp + 0x100000000 : zm_tmp \
     
     *tfp0 = kernel_task;
     *kslide = slide;
-//    *kernucred = kern_ucred;
+    *kernucred = kern_ucred;
 //    *selfproc = self_proc;
+    
     retval = KERN_SUCCESS;
     
+    
+    
 out5:;
     _kernelrpc_mach_port_destroy_trap(self, maps[0]);
     _kernelrpc_mach_port_destroy_trap(self, maps[1]);