main.m 7.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217
  1. #import <Foundation/Foundation.h>
  2. #import <os/log.h>
  3. #include <pthread.h>
  4. #include <mach/mach.h>
  5. #include <mach/error.h>
  6. #include <mach/message.h>
  7. #include <string.h>
  8. #include <unistd.h>
  9. #include <sys/types.h>
  10. #include <sys/stat.h>
  11. #include "kexecute.h"
  12. #include "kern_utils.h"
  13. #include "patchfinder64.h"
  14. #include "mach/jailbreak_daemonServer.h"
  15. #define JAILBREAKDDEBUG 1
  16. #define CS_OPS_STATUS 0 /* return status */
  17. #define CS_GET_TASK_ALLOW 0x0000004 /* has get-task-allow entitlement */
  18. #define CS_INSTALLER 0x0000008 /* has installer entitlement */
  19. #define CS_HARD 0x0000100 /* don't load invalid pages */
  20. #define CS_KILL 0x0000200 /* kill process if it becomes invalid */
  21. #define CS_RESTRICT 0x0000800 /* tell dyld to treat restricted */
  22. #define CS_PLATFORM_BINARY 0x4000000 /* this is a platform binary */
  23. #define CS_DEBUGGED 0x10000000 /* process is currently or has previously been debugged and allowed to run with invalid pages */
  24. int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize);
  25. #define PROC_PIDPATHINFO_MAXSIZE (1024)
  26. int proc_pidpath(pid_t pid, void *buffer, uint32_t buffersize);
  27. typedef boolean_t (*dispatch_mig_callback_t)(mach_msg_header_t *message, mach_msg_header_t *reply);
  28. mach_msg_return_t dispatch_mig_server(dispatch_source_t ds, size_t maxmsgsz, dispatch_mig_callback_t callback);
  29. kern_return_t bootstrap_check_in(mach_port_t bootstrap_port, const char *service, mach_port_t *server_port);
  30. #define MEMORYSTATUS_CMD_SET_JETSAM_TASK_LIMIT 6
  31. int memorystatus_control(uint32_t command, int32_t pid, uint32_t flags, void *buffer, size_t buffersize);
  32. int remove_memory_limit(void) {
  33. // daemons run under launchd have a very stingy memory limit by default, we need
  34. // quite a bit more for patchfinder so disable it here
  35. // (note that we need the com.apple.private.memorystatus entitlement to do so)
  36. pid_t my_pid = getpid();
  37. return memorystatus_control(MEMORYSTATUS_CMD_SET_JETSAM_TASK_LIMIT, my_pid, 0, NULL, 0);
  38. }
  39. #define JAILBREAKD_COMMAND_ENTITLE 1
  40. #define JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT 2
  41. #define JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY 3
  42. #define JAILBREAKD_COMMAND_FIXUP_SETUID 4
  43. int is_valid_command(uint8_t command) {
  44. return (command == JAILBREAKD_COMMAND_ENTITLE ||
  45. command == JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT ||
  46. command == JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY ||
  47. command == JAILBREAKD_COMMAND_FIXUP_SETUID);
  48. }
  49. int handle_command(uint8_t command, uint32_t pid) {
  50. if (!is_valid_command(command)) {
  51. fprintf(stderr,"Invalid command recieved.\n");
  52. return 1;
  53. }
  54. if (command == JAILBREAKD_COMMAND_ENTITLE) {
  55. #ifdef JAILBREAKDDEBUG
  56. fprintf(stderr,"JAILBREAKD_COMMAND_ENTITLE PID: %d\n", pid);
  57. #endif
  58. setcsflagsandplatformize(pid);
  59. }
  60. if (command == JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT) {
  61. #ifdef JAILBREAKDDEBUG
  62. fprintf(stderr,"JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT PID: %d\n", pid);
  63. #endif
  64. setcsflagsandplatformize(pid);
  65. kill(pid, SIGCONT);
  66. }
  67. if (command == JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY) {
  68. #ifdef JAILBREAKDDEBUG
  69. fprintf(stderr,"JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY PID: %d\n", pid);
  70. #endif
  71. __block int PID = pid;
  72. dispatch_queue_t queue = dispatch_queue_create("org.coolstar.jailbreakd.delayqueue", NULL);
  73. dispatch_async(queue, ^{
  74. char pathbuf[PROC_PIDPATHINFO_MAXSIZE];
  75. bzero(pathbuf, sizeof(pathbuf));
  76. int tries = 0;
  77. int ret = proc_pidpath(PID, pathbuf, sizeof(pathbuf));
  78. while (ret > 0 && strcmp(pathbuf, "/usr/libexec/xpcproxy") == 0 && tries < 5000){
  79. proc_pidpath(PID, pathbuf, sizeof(pathbuf));
  80. usleep(100);
  81. tries++;
  82. }
  83. if (tries >= 5000){
  84. fprintf(stderr, "Warning: xpcproxy timer timed out for PID %d\n", pid);
  85. }
  86. uint32_t flags;
  87. csops(pid, CS_OPS_STATUS, &flags, 0);
  88. #ifdef JAILBREAKDDEBUG
  89. fprintf(stderr, "Waiting for CSFlags to reset for PID %d...\n", pid);
  90. #endif
  91. tries = 0;
  92. while ((flags & (CS_PLATFORM_BINARY | CS_INSTALLER | CS_GET_TASK_ALLOW | CS_DEBUGGED)) != 0 &&
  93. (flags & (CS_RESTRICT | CS_HARD | CS_KILL)) == 0 &&
  94. tries < 5000){
  95. csops(pid, CS_OPS_STATUS, &flags, 0);
  96. usleep(100);
  97. tries++;
  98. }
  99. if (tries >= 5000){
  100. fprintf(stderr, "Warning: CSFlag timer timed out for PID %d\n", pid);
  101. }
  102. setcsflagsandplatformize(PID);
  103. kill(PID, SIGCONT);
  104. #ifdef JAILBREAKDDEBUG
  105. fprintf(stderr,"Called SIGCONT on pid %d from ENTITLE_AND_SIGCONT_FROM_XPCPROXY\n", PID);
  106. #endif
  107. });
  108. dispatch_release(queue);
  109. }
  110. if (command == JAILBREAKD_COMMAND_FIXUP_SETUID) {
  111. #ifdef JAILBREAKDDEBUG
  112. fprintf(stderr,"JAILBREAKD_FIXUP_SETUID PID: %d\n", pid);
  113. #endif
  114. fixupsetuid(pid);
  115. }
  116. return 0;
  117. }
  118. kern_return_t jbd_call(mach_port_t server_port, uint8_t command, uint32_t pid) {
  119. #ifdef JAILBREAKDDEBUG
  120. fprintf(stderr,"[Mach] New call from %llx: command %x, pid %d\n", server_port, command, pid);
  121. #endif
  122. return (handle_command(command, pid) == 0) ? KERN_SUCCESS : KERN_FAILURE;
  123. }
  124. mach_port_t tfpzero;
  125. uint64_t kernel_base;
  126. uint64_t kernel_slide;
  127. extern unsigned offsetof_ip_kobject;
  128. int main(int argc, char **argv, char **envp) {
  129. fprintf(stderr,"jailbreakd: start\n");
  130. unlink("/var/run/jailbreakd.pid");
  131. kernel_base = strtoull(getenv("KernelBase"), NULL, 16);
  132. remove_memory_limit();
  133. kern_return_t err = host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &tfpzero);
  134. if (err != KERN_SUCCESS) {
  135. fprintf(stderr,"host_get_special_port 4: %s\n", mach_error_string(err));
  136. return 5;
  137. }
  138. init_kernel(kernel_base, NULL);
  139. // Get the slide
  140. kernel_slide = kernel_base - 0xFFFFFFF007004000;
  141. fprintf(stderr,"jailbreakd: slide: 0x%016llx\n", kernel_slide);
  142. // prime offset caches
  143. find_allproc();
  144. find_add_x0_x0_0x40_ret();
  145. find_OSBoolean_True();
  146. find_OSBoolean_False();
  147. find_zone_map_ref();
  148. find_osunserializexml();
  149. find_smalloc();
  150. init_kexecute();
  151. term_kernel();
  152. @autoreleasepool {
  153. // set up mach stuff
  154. mach_port_t server_port;
  155. if ((err = bootstrap_check_in(bootstrap_port, "org.coolstar.jailbreakd", &server_port))) {
  156. fprintf(stderr,"Failed to check in: %s\n", mach_error_string(err));
  157. return -1;
  158. }
  159. dispatch_source_t server = dispatch_source_create(DISPATCH_SOURCE_TYPE_MACH_RECV, server_port, 0, dispatch_get_main_queue());
  160. dispatch_source_set_event_handler(server, ^{
  161. dispatch_mig_server(server, jbd_jailbreak_daemon_subsystem.maxsize, jailbreak_daemon_server);
  162. });
  163. dispatch_resume(server);
  164. fprintf(stderr,"it never fails to strike its target, and the wounds it causes do not heal\n");
  165. fprintf(stderr,"in other words, MIG is online\n");
  166. int fd = open("/var/run/jailbreakd.pid", O_WRONLY | O_CREAT, 0600);
  167. char mmmm[8] = {0};
  168. int sz = snprintf(mmmm, 8, "%d", getpid());
  169. write(fd, mmmm, sz);
  170. close(fd);
  171. fprintf(stderr,"jailbreakd: dumped pid\n");
  172. dispatch_main();
  173. }
  174. return EXIT_FAILURE;
  175. }