Comments (7)
@NewDwarf You need platform-application entitlement.
$ cat ent.plist
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>platform-application</key>
<true/>
</dict>
</plist>
$ jtool --sign --inplace --ent ent.plist hello
from async_wake-fun.
Hm ok. I didn't expect inject_amfid to be in a zombie state - i guess opening a seperate thread with dlopen still has the constructor running - might look into it, or just turn it into some useful daemon.
inject_amfid is a simple process that takes in the pid of amfid. it then retrieves the task port of it. Them uses some of ian beers code from triple_fetch to call a function remotely in a process. we can do this since pretty much all functions are loaded in from the dyld_shared_cache, which has a shared address space (for efficiency reasons). We call dlopen in amfid with our own dylib (amfid_payload.dylib). This dylib pretty much just replaces the function pointer to MISValidateSignatureAndCopyInfo with our own. Note that whenever a binary references a function statically, its reference put into a section within the macho, which is what we override.
The reason I can replace the pointer to the real function with my function, and it still works, is because we dlopen'd our dylib in the amfid space, but didnt dlclose it. this means that everything is still "loaded" into amfid's address space - so we can still call it. (however this does mean there is a random handle still in there, but it doesnt really matter)
from async_wake-fun.
Nice idea. Thanks for the explanation. Do you have plans to put http://newosxbook.com/files/binpack64.tar in your app? The content of this archive is already signed by SHA-256 and suitable for using in iOS 11
from async_wake-fun.
It looks like your injector for amfid doesn't work. I created the test app and run it.
The test app doesn't run until the hash would not be inserted into the trusted kernel cache.
from async_wake-fun.
@NewDwarf Why doesn't it work? Make sure your app is arm64 (not FAT), SHA-256 signed and either has platform-application entitlement or is launched by launchd.
from async_wake-fun.
Here is the sample code:
cat hello.m
#import <Foundation/Foundation.h>
int main (int argc, const char * argv[])
{
NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
NSLog (@"Hello, World!");
[pool drain];
return 0;
}
Yes, it is thin arm64 app and pseudo-signed (sha-256) by jtool.
otool -h hello
Mach header
magic cputype cpusubtype caps filetype ncmds sizeofcmds flags
0xfeedfacf 16777228 0 0x00 2 20 1880 0x00200085
jtool --sig hello
Blob at offset: 49648 (624 bytes) is an embedded signature
Code Directory (574 bytes)
Version: 20001
Flags: none
CodeLimit: 0xc1f0
Identifier: hello (0x58)
CDHash: 92bf521f43a475303d9d3e3cd65d1bf5fe84ed140b1b457cfa338fa8a8f5c59f (computed)
# of Hashes: 13 code + 2 special
Hashes @158 size: 32 Type: SHA-256
Empty requirement set (12 bytes)
When I run the 'hello' from the main app or from the shell console, 'hello' is killed by the kernel as amfid patched by amfid_payload.dylib returns 'Bad Signature' (I guess).
If I insert the hash into the kernel's trust cache, the 'hello' works fine.
This is a reason why I told that amfid hooking doesn't work.
What was your solution? How did you verify that pseudo signed third party code run fine?
from async_wake-fun.
@stek29 Thank you!
from async_wake-fun.
Related Issues (20)
- build fails HOT 6
- Kernel panic on iPad Air 2 HOT 3
- Adding New Symbols Doesn't Work HOT 2
- Kernel panic on iPhone SE HOT 11
- Kernel Crashes On iPhone SE 11.1.2 HOT 6
- Crashing issue HOT 8
- Panic!! HOT 7
- kcall vs kexecute HOT 3
- Kernel Panic HOT 2
- Could not find "libproc.h" file HOT 7
- [QUESTION]What happened to lldb debugging? HOT 6
- Now kernel panics everytime it's ran HOT 2
- [@ninjaprawn] Question regarding offsets HOT 8
- Any info about supported iOS\devices?
- "terminated due to signal 9" on output HOT 4
- Springboard: (os/kern) failure HOT 3
- ssh broken? HOT 1
- Undefined symbols for architecture arm64 HOT 4
- qwertyoruiop's kpp bypass HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from async_wake-fun.