branches/meklortOld/i386/modules/KernelPatcher/kernel_patcher.c - Chameleon Svn Source Tree - Chameleon open source boot loader project.

Root/branches/meklortOld/i386/modules/KernelPatcher/kernel_patcher.c

Source at commit 1166 created 13 years 10 days ago. By meklort, Fixed recent Makefile changes. Please do not use /Users/evan/SourceCode/tmp/chameleon/trunk or VPATH. the only time you should use /Users/evan/SourceCode/tmp/chameleon/trunk is when setting the SRCROOT variable. Also note that very soon make pkg is going to be removed. The pkg build script in trunk is very out of date. Instead please use the package maker at http://forge.voodooprojects.org/p/chameleonApplications/. Once this is ready for trunk it will be merged.
1	␉/*␊
2	* Copyright (c) 2009-2010 Evan Lojewski. All rights reserved.␊
3	*␊
4	*/␊
5	␊
6	#include "libsaio.h"␊
7	#include "kernel_patcher.h"␊
8	#include "platform.h"␊
9	#include "modules.h"␊
10	extern PlatformInfo_t* Platform;␊
11	␊
12	patchRoutine_t* patches = NULL;␊
13	kernSymbols_t* kernelSymbols = NULL;␊
14	␊
15	␊
16	void KernelPatcher_start()␊
17	{␊
18	␉register_kernel_patch(patch_cpuid_set_info_all, KERNEL_ANY, CPUID_MODEL_UNKNOWN); ␊
19	␊
20	␉register_kernel_patch(patch_commpage_stuff_routine, KERNEL_ANY, CPUID_MODEL_ANY);␊
21	␉␊
22	␉register_kernel_patch(patch_lapic_init, KERNEL_ANY, CPUID_MODEL_ANY);␊
23	␊
24	␉// NOTE: following is currently 32bit only␊
25	␉register_kernel_patch(patch_lapic_configure, KERNEL_32, CPUID_MODEL_ANY);␊
26	␊
27	␉␊
28	␉register_kernel_symbol(KERNEL_ANY, "_panic");␊
29	␉register_kernel_symbol(KERNEL_ANY, "_cpuid_set_info");␊
30	␉register_kernel_symbol(KERNEL_ANY, "_pmCPUExitHaltToOff");␊
31	␉register_kernel_symbol(KERNEL_ANY, "_lapic_init");␊
32	␉register_kernel_symbol(KERNEL_ANY, "_commpage_stuff_routine");␊
33	␊
34	␉// lapic_configure symbols␊
35	␉register_kernel_symbol(KERNEL_ANY, "_lapic_configure");␊
36	␉register_kernel_symbol(KERNEL_ANY, "_lapic_start");␊
37	␉register_kernel_symbol(KERNEL_ANY, "_lapic_interrupt_base");␊
38	␉␊
39	␉// lapic_interrupt symbols␊
40	␉//register_kernel_patch(patch_lapic_interrupt, KERNEL_ANY, CPUID_MODEL_ANY);␊
41	␉//register_kernel_symbol(KERNEL_ANY, "_lapic_interrupt");␊
42	␊
43	␊
44	␉␊
45	␉// TODO: register needed symbols␊
46	␉␊
47	␉␊
48	␉register_hook_callback("ExecKernel", &patch_kernel); ␊
49	}␊
50	␊
51	/*␊
52	* Register a kerenl patch␊
53	*/␊
54	void register_kernel_patch(void* patch, int arch, int cpus)␊
55	{␊
56	␉// TODO: only insert valid patches based on current cpuid and architecture␊
57	␉// AKA, don't at 64bit patches if it's a 32bit only machine␊
58	␉patchRoutine_t* entry;␊
59	␉␊
60	␉// Check to ensure that the patch is valid on this machine␊
61	␉// If it is not, exit early from this function␊
62	␉if(cpus != Platform->CPU.Model)␊
63	␉{␊
64	␉␉if(cpus != CPUID_MODEL_ANY)␊
65	␉␉{␊
66	␉␉␉if(cpus == CPUID_MODEL_UNKNOWN)␊
67	␉␉␉{␊
68	␉␉␉␉switch(Platform->CPU.Model)␊
69	␉␉␉␉{␊
70	␉␉␉␉␉case 13:␊
71	␉␉␉␉␉case CPUID_MODEL_YONAH:␊
72	␉␉␉␉␉case CPUID_MODEL_MEROM:␊
73	␉␉␉␉␉case CPUID_MODEL_PENRYN:␊
74	␉␉␉␉␉case CPUID_MODEL_NEHALEM:␊
75	␉␉␉␉␉case CPUID_MODEL_FIELDS:␊
76	␉␉␉␉␉case CPUID_MODEL_DALES:␊
77	␉␉␉␉␉case CPUID_MODEL_NEHALEM_EX:␊
78	␉␉␉␉␉␉// Known cpu's we don't want to add the patch␊
79	␉␉␉␉␉␉return;␊
80	␉␉␉␉␉␉break;␊
81	␊
82	␉␉␉␉␉default:␊
83	␉␉␉␉␉␉// CPU not in supported list, so we are going to add␊
84	␉␉␉␉␉␉// The patch will be applied␊
85	␉␉␉␉␉␉break;␊
86	␉␉␉␉␉␉␊
87	␉␉␉␉}␊
88	␉␉␉}␊
89	␉␉␉else␊
90	␉␉␉{␊
91	␉␉␉␉// Invalid cpuid for current cpu. Ignoring patch␊
92	␉␉␉␉return;␊
93	␉␉␉}␊
94	␊
95	␉␉}␊
96	␉}␊
97	␉␉␊
98	␉if(patches == NULL)␊
99	␉{␊
100	␉␉patches = entry = malloc(sizeof(patchRoutine_t));␊
101	␉}␊
102	␉else␊
103	␉{␊
104	␉␉entry = patches;␊
105	␉␉while(entry->next)␊
106	␉␉{␊
107	␉␉␉entry = entry->next;␊
108	␉␉}␊
109	␉␉␊
110	␉␉entry->next = malloc(sizeof(patchRoutine_t));␊
111	␉␉entry = entry->next;␊
112	␉}␊
113	␉␊
114	␉entry->next = NULL;␊
115	␉entry->patchRoutine = patch;␊
116	␉entry->validArchs = arch;␊
117	␉entry->validCpu = cpus;␊
118	}␊
119	␊
120	void register_kernel_symbol(int kernelType, const char* name)␊
121	{␊
122	␉if(kernelSymbols == NULL)␊
123	␉{␊
124	␉␉kernelSymbols = malloc(sizeof(kernSymbols_t));␊
125	␉␉kernelSymbols->next = NULL;␊
126	␉␉kernelSymbols->symbol = (char*)name;␊
127	␉␉kernelSymbols->addr = 0;␊
128	␉}␊
129	␉else {␊
130	␉␉kernSymbols_t *symbol = kernelSymbols;␊
131	␉␉while(symbol->next != NULL)␊
132	␉␉{␊
133	␉␉␉symbol = symbol->next;␊
134	␉␉}␊
135	␉␉␊
136	␉␉symbol->next = malloc(sizeof(kernSymbols_t));␊
137	␉␉symbol = symbol->next;␊
138	␊
139	␉␉symbol->next = NULL;␊
140	␉␉symbol->symbol = (char*)name;␊
141	␉␉symbol->addr = 0;␊
142	␉}␊
143	}␊
144	␊
145	kernSymbols_t* lookup_kernel_symbol(const char* name)␊
146	{␊
147	␉kernSymbols_t *symbol = kernelSymbols;␊
148	␊
149	␉while(symbol && strcmp(symbol->symbol, name) !=0)␊
150	␉{␊
151	␉␉symbol = symbol->next;␊
152	␉}␊
153	␉␊
154	␉if(!symbol)␊
155	␉{␊
156	␉␉return NULL;␊
157	␉}␊
158	␉else␊
159	␉{␊
160	␉␉return symbol;␊
161	␉}␊
162	␊
163	}␊
164	␊
165	void patch_kernel(void* kernelData, void* arg2, void* arg3, void *arg4)␊
166	{␊
167	␉patchRoutine_t* entry = patches;␊
168	␊
169	␉␊
170	␉int arch = determineKernelArchitecture(kernelData);␊
171	␊
172	␉locate_symbols(kernelData);␊
173	␉␊
174	␉if(patches != NULL)␊
175	␉{␊
176	␉␉while(entry)␊
177	␉␉{␊
178	␉␉␉if(entry->validArchs == KERNEL_ANY \|\| arch == entry->validArchs)␊
179	␉␉␉{␊
180	␉␉␉␉if(entry->patchRoutine) entry->patchRoutine(kernelData);␊
181	␉␉␉}␊
182	␉␉␉entry = entry->next;␊
183	␉␉}␊
184	␉}␊
185	}␊
186	␊
187	int determineKernelArchitecture(void* kernelData)␊
188	{␉␊
189	␉if(((struct mach_header*)kernelData)->magic == MH_MAGIC)␊
190	␉{␊
191	␉␉return KERNEL_32;␊
192	␉}␊
193	␉if(((struct mach_header*)kernelData)->magic == MH_MAGIC_64)␊
194	␉{␊
195	␉␉return KERNEL_64;␊
196	␉}␊
197	␉else␊
198	␉{␊
199	␉␉return KERNEL_ERR;␊
200	␉}␊
201	}␊
202	␊
203	␊
204	/**␊
205	**␉␉This functions located the requested symbols in the mach-o file.␊
206	**␉␉␉as well as determines the start of the __TEXT segment and __TEXT,__text sections␊
207	**/␊
208	int locate_symbols(void* kernelData)␊
209	{␊
210	␉char is64 = 1;␊
211	␉parse_mach(kernelData, NULL, symbol_handler);␊
212	␉//handle_symtable((UInt32)kernelData, symtableData, &symbol_handler, determineKernelArchitecture(kernelData) == KERNEL_64);␊
213	␉return 1 << is64;␊
214	}␊
215	␊
216	long long symbol_handler(char* symbolName, long long addr, char is64)␊
217	{␊
218	␉// Locate the symbol in the list, if it exists, update it's address␊
219	␉kernSymbols_t *symbol = lookup_kernel_symbol(symbolName);␊
220	␉␊
221	␉if(symbol)␊
222	␉{␊
223	␉␉symbol->addr = addr;␊
224	␉}␊
225	␉␊
226	␉return 0xFFFFFFFF; // fixme␊
227	}␊
228	␊
229	␊
230	/**␊
231	** Locate the fisrt instance of _panic inside of _cpuid_set_info, and either remove it␊
232	** Or replace it so that the cpuid is set to a valid value.␊
233	**/␊
234	void patch_cpuid_set_info_all(void* kernelData)␊
235	{␊
236	␉switch(Platform->CPU.Model)␊
237	␉{␊
238	␉␉case CPUID_MODEL_ATOM:␊
239	␉␉␉if(determineKernelArchitecture(kernelData) == KERNEL_32)␊
240	␉␉␉{␊
241	␉␉␉␉patch_cpuid_set_info_32(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN); ␊
242	␉␉␉}␊
243	␉␉␉else ␊
244	␉␉␉{␊
245	␉␉␉␉patch_cpuid_set_info_64(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN); ␊
246	␊
247	␉␉␉}␊
248	␊
249	␉␉␉break;␊
250	␉␉␉␊
251	␉␉default:␊
252	␉␉␉if(determineKernelArchitecture(kernelData) == KERNEL_32)␊
253	␉␉␉{␊
254	␉␉␉␉patch_cpuid_set_info_32(kernelData, 0, 0);␊
255	␉␉␉}␊
256	␉␉␉else␊
257	␉␉␉{␊
258	␉␉␉␉patch_cpuid_set_info_64(kernelData, 0, 0);␊
259	␉␉␉}␊
260	␊
261	␉␉␉break;␊
262	␉}␊
263	}␊
264	void patch_cpuid_set_info_64(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
265	{␊
266	␉UInt8* bytes = (UInt8*)kernelData;␊
267	␉␊
268	␉kernSymbols_t *symbol = lookup_kernel_symbol("_cpuid_set_info");␊
269	␉␊
270	␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; //␉(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
271	␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
272	␉␊
273	␉␊
274	␉␊
275	␉//UInt32 jumpLocation = 0;␊
276	␉␊
277	␉␊
278	␉if(symbol == 0 \|\| symbol->addr == 0)␊
279	␉{␊
280	␉␉verbose("Unable to locate _cpuid_set_info\n");␊
281	␉␉return;␊
282	␉␉␊
283	␉}␊
284	␉␊
285	␉symbol = lookup_kernel_symbol("_panic");␊
286	␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; //kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
287	␉if(symbol == 0 \|\| symbol->addr == 0)␊
288	␉{␊
289	␉␉printf("Unable to locate _panic\n");␊
290	␉␉return;␊
291	␉}␊
292	␉panicAddr -= (UInt32)kernelData;␊
293	␉␊
294	␉␊
295	␉␊
296	␉//TODO: don't assume it'll always work (Look for next function address in symtab and fail once it's been reached)␊
297	␉while( ␊
298	␉␉ (bytes[patchLocation -1] != 0xE8) \|\|␊
299	␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 \| ␊
300	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 \| ␊
301	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 \|␊
302	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
303	␉␉ )␊
304	␉{␊
305	␉␉patchLocation++;␊
306	␉}␊
307	␉patchLocation--;␊
308	␉␊
309	␉// Remove panic just in ca se␊
310	␉// The panic instruction is exactly 5 bytes long.␊
311	␉bytes[patchLocation + 0] = 0x90;␊
312	␉bytes[patchLocation + 1] = 0x90;␊
313	␉bytes[patchLocation + 2] = 0x90;␊
314	␉bytes[patchLocation + 3] = 0x90;␊
315	␉bytes[patchLocation + 4] = 0x90;␊
316	␉␊
317	␉␊
318	␉␊
319	␉// Check for a 10.2.0+ kernel␊
320	␉if(bytes[patchLocation - 19] == 0xC7 && bytes[patchLocation - 18] == 0x05)␊
321	␉{␊
322	␉␉␊
323	␉␉UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 17] << 0 \|␊
324	␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 16] << 8 \|␊
325	␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 15] << 16 \|␊
326	␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 14] << 24;␊
327	␉␉␊
328	␉␉// NOTE: may change, determined based on cpuid_info struct␊
329	␉␉UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 310; ␊
330	␉␉␊
331	␉␉␊
332	␉␉//ffffff8000228b3b -> 0x00490e8b␊
333	␉␉//ffffff8000228c28 -> -237 -> 0x490D9E -> -310␊
334	␉␉␊
335	␉␉␊
336	␉␉// The mov is 10 bytes␊
337	␉␉/*␊
338	␉␉ bytes[patchLocation - 19] = 0x90;␉// c7␊
339	␉␉ bytes[patchLocation - 18] = 0x90;␉// 05␊
340	␉␉ bytes[patchLocation - 17] = 0x90;␉// family location␊
341	␉␉ bytes[patchLocation - 16] = 0x90;␉// family location␊
342	␉␉ bytes[patchLocation - 15] = 0x90;␉// family location␊
343	␉␉ bytes[patchLocation - 14] = 0x90;␉// family location␊
344	␉␉ */␊
345	␉␉bytes[patchLocation - 13] = (impersonateFamily & 0x000000FF) >> 0;␊
346	␉␉bytes[patchLocation - 12] = (impersonateFamily & 0x0000FF00) >> 8;␊
347	␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
348	␉␉bytes[patchLocation - 10] = (impersonateFamily & 0xFF000000) >> 24;␊
349	␉␉␊
350	␉␉␊
351	␉␉// The lea (%rip),%rip is 7 bytes␊
352	␉␉bytes[patchLocation - 9] = 0xC7;␊
353	␉␉bytes[patchLocation - 8] = 0x05;␊
354	␉␉bytes[patchLocation - 7] = ((cpuid_model_addr -10) & 0x000000FF) >> 0;␉// NOTE: this opcode is relative in 64bit mode, subtract offset␊
355	␉␉bytes[patchLocation - 6] = ((cpuid_model_addr -10) & 0x0000FF00) >> 8;␉␊
356	␉␉bytes[patchLocation - 5] = ((cpuid_model_addr -10) & 0x00FF0000) >> 16;␊
357	␉␉bytes[patchLocation - 4] = ((cpuid_model_addr -10) & 0xFF000000) >> 24;␊
358	␉␉bytes[patchLocation - 3] = impersonateModel;␉// cpuid_model␊
359	␉␉␊
360	␉␉ ␊
361	␉␉ ␊
362	␉␉ // The xor eax eax is 2 bytes␊
363	␉␉bytes[patchLocation - 2] = 0x01;␉// cpuid_extmodel␊
364	␉␉bytes[patchLocation - 1] = 0x00;␉// cpuid_extfamily␊
365	␉␉␊
366	␉␉// The panic instruction is exactly 5 bytes long.␊
367	␉␉bytes[patchLocation - 0] = 0x02;␉// cpuid_stepping␊
368	␉␉/*bytes[patchLocation + 1] = 0x90;␊
369	␉␉bytes[patchLocation + 2] = 0x90;␊
370	␉␉bytes[patchLocation + 3] = 0x90;␊
371	␉␉bytes[patchLocation + 4] = 0x90;␊
372	␉␉*/␊
373	␉␉␊
374	␉␉// Panic call has been removed.␊
375	␉␉// Override the CPUID now. This requires ~ 10 bytes on 10.0.0 kernels␊
376	␉␉// On 10.2.0+ kernels, this requires ~16 bytes␊
377	␉␉␊
378	␉␉// Total: 24 bytes␊
379	␉␉printf("Running on a 10.2.0+ kernel\n");␊
380	␉␉getc();␊
381	␊
382	␉}␊
383	␉else {␊
384	␉␉printf("Running on a 10.0.0 kernel, patch unsupported\n");␊
385	␉␉getc();␊
386	␉}␊
387	␊
388	␉␊
389	}␊
390	␊
391	␊
392	␊
393	␊
394	␊
395	void patch_cpuid_set_info_32(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
396	{␊
397	␉UInt8* bytes = (UInt8*)kernelData;␊
398	␉␊
399	␉kernSymbols_t *symbol = lookup_kernel_symbol("_cpuid_set_info");␊
400	␊
401	␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; //␉(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
402	␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
403	␉UInt32 addrLocation = patchLocation;␊
404	␉␊
405	␊
406	␉UInt32 jumpLocation = 0;␊
407	␉␊
408	␉␊
409	␉if(symbol == 0 \|\| symbol->addr == 0)␊
410	␉{␊
411	␉␉verbose("Unable to locate _cpuid_set_info\n");␊
412	␉␉return;␊
413	␉␉␊
414	␉}␊
415	␊
416	␉symbol = lookup_kernel_symbol("_panic");␊
417	␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; //kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
418	␉if(symbol == 0 \|\| symbol->addr == 0)␊
419	␉{␊
420	␉␉printf("Unable to locate _panic\n");␊
421	␉␉return;␊
422	␉}␊
423	␉panicAddr -= (UInt32)kernelData;␊
424	␊
425	␉␊
426	␊
427	␉//TODO: don't assume it'll always work (Look for next function address in symtab and fail once it's been reached)␊
428	␉while( ␊
429	␉␉ (bytes[patchLocation -1] != 0xE8) \|\|␊
430	␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 \| ␊
431	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 \| ␊
432	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 \|␊
433	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
434	␉␉ )␊
435	␉{␊
436	␉␉patchLocation++;␊
437	␉}␊
438	␉patchLocation--;␊
439	␉␊
440	␉// Remove panic call, just in case the following patch routines fail␊
441	␉bytes[patchLocation + 0] = 0x90;␊
442	␉bytes[patchLocation + 1] = 0x90;␊
443	␉bytes[patchLocation + 2] = 0x90;␊
444	␉bytes[patchLocation + 3] = 0x90;␊
445	␉bytes[patchLocation + 4] = 0x90;␊
446	␉␊
447	␉␊
448	␉// Locate the jump call, so that 10 bytes can be reclamed.␊
449	␉// NOTE: This will NOT be located on pre 10.6.2 kernels␊
450	␉jumpLocation = patchLocation - 15;␊
451	␉while((bytes[jumpLocation - 1] != 0x77 \|\|␊
452	␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation - 18)) &&␊
453	␉␉ (patchLocation - jumpLocation) < 0xF0)␊
454	␉{␊
455	␉␉jumpLocation--;␊
456	␉}␊
457	␉// If found... AND we want to impersonate a specific cpumodel / family...␊
458	␉if(impersonateFamily && impersonateModel &&␊
459	␉ ((patchLocation - jumpLocation) < 0xF0))␊
460	␉{␊
461	␉␉bytes[jumpLocation] -= 10;␉␉// sizeof(movl␉$0x6b5a4cd2,0x00872eb4) = 10bytes␊
462	␉␉␊
463	␉␉/* ␊
464	␉␉ * Inpersonate the specified CPU FAMILY and CPU Model␊
465	␉␉ */␊
466	␉␉//␉␉␉␉␉␉␉␉␉cpuid_cpufamily_addr, impersonateFamily␉␉␉␉␉␉␉␉␉cpuid_model_addr␉ impersonateModel␊
467	␉␉//char new_bytes[] = {0xC7, 0x05, 0x__, 0x__, 0x__, 0x__, 0x__, 0x__, 0x__, 0x__, 0x90, 0x90, 0xC7, 0x05, 0x__, 0x__, 0x__, 0x__, 0x__, 0x01, 0x00, 0x02};␊
468	␉␉// bytes[patchLocation - 17] = 0xC7;␉// already here... not needed to be done␊
469	␉␉// bytes[patchLocation - 16] = 0x05;␉// see above␊
470	␉␉//UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 15] << 0 \|␊
471	␉␉//␉␉␉␉␉␉␉␉bytes[patchLocation - 14] << 8 \|␊
472	␉␉//␉␉␉␉␉␉␉␉bytes[patchLocation - 13] << 16 \|␊
473	␉␉//␉␉␉␉␉␉␉␉bytes[patchLocation - 12] << 24;␊
474	␉␉␊
475	␉␉// NOTE: may change, determined based on cpuid_info struct: TODO: read from binary␊
476	␉␉//UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 295; ␊
477	␉␉␊
478	␉␉␊
479	␉␉// cpufamily␊
480	␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x000000FF) >> 0;␊
481	␉␉bytes[patchLocation - 10] = (impersonateFamily & 0x0000FF00) >> 8;␊
482	␉␉bytes[patchLocation - 9] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
483	␉␉bytes[patchLocation - 8] = (impersonateFamily & 0xFF000000) >> 24;␊
484	␉␉␊
485	␉␉// NOPS, just in case if the jmp call wasn't patched, we'll jump to a␊
486	␉␉// nop and continue with the rest of the patch␊
487	␉␉// Yay two free bytes :), 10 more can be reclamed if needed, as well as a few␊
488	␉␉// from the above code (only cpuid_model needs to be set.␊
489	␉␉bytes[patchLocation - 7] = 0x90;␊
490	␉␉bytes[patchLocation - 6] = 0x90;␊
491	␉␉␊
492	␉␉bytes[patchLocation - 5] = 0xC7;␊
493	␉␉bytes[patchLocation - 4] = 0x05;␊
494	␉␉␊
495	␉␉// Locate cpuid_addr_addr -> first four bytes after 8b 45 d8 25 f0 00 00 00 c1 e8 04 a2␊
496	␉␉while(bytes[addrLocation -12] != 0x8B \|\|␊
497	␉␉␉ bytes[addrLocation -11] != 0x45 \|\|␊
498	␉␉␉ bytes[addrLocation -10] != 0xD8 \|\|␊
499	␉␉␉ bytes[addrLocation -9] != 0x25 \|\|␊
500	␉␉␉ bytes[addrLocation -8] != 0xF0 \|\|␊
501	␉␉␉ bytes[addrLocation -7] != 0x00 \|\|␊
502	␉␉␉ bytes[addrLocation -6] != 0x00 \|\|␊
503	␉␉␉ bytes[addrLocation -5] != 0x00 \|\|␊
504	␉␉␉ bytes[addrLocation -4] != 0xC1 \|\|␊
505	␉␉␉ bytes[addrLocation -3] != 0xE8 \|\|␊
506	␉␉␉ bytes[addrLocation -2] != 0x04 \|\|␊
507	␉␉␉ bytes[addrLocation -1] != 0xA2)␊
508	␉␉{␊
509	␉␉␉// TODO: break if location is too large␊
510	␉␉␉addrLocation++;␊
511	␉␉}␉␉␊
512	␉␉␊
513	␉␉bytes[patchLocation - 3] = bytes[addrLocation];␊
514	␉␉bytes[patchLocation - 2] = bytes[addrLocation+1];␉␊
515	␉␉bytes[patchLocation - 1] = bytes[addrLocation+2];␊
516	␉␉bytes[patchLocation - 0] = bytes[addrLocation+3];␊
517	␉␉␊
518	␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
519	␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
520	␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
521	␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
522	␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
523	␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␉␉␊
524	␉}␊
525	␉else if(impersonateFamily && impersonateModel)␊
526	␉{␊
527	␊
528	␉␉// pre 10.6.2 kernel␊
529	␉␉// Locate the jump to directly after the panic call,␊
530	␉␉jumpLocation = patchLocation - 4;␊
531	␉␉while((bytes[jumpLocation - 1] != 0x77 \|\|␊
532	␉␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation + 4)) &&␊
533	␉␉␉ (patchLocation - jumpLocation) < 0x20)␊
534	␉␉{␊
535	␉␉␉jumpLocation--;␊
536	␉␉}␊
537	␉␉// NOTE above isn't needed (I was going to use it, but I'm not, so instead,␊
538	␉␉// I'll just leave it to verify the binary stucture.␊
539	␉␉␊
540	␉␉// NOTE: the cpumodel_familt data is not set in _cpuid_set_info␊
541	␉␉// so we don't need to set it here, I'll get set later based on the model␊
542	␉␉// we set now.␊
543	␉␉␊
544	␉␉if((patchLocation - jumpLocation) < 0x20)␊
545	␉␉{␊
546	␉␉␉UInt32 cpuid_model_addr =␉(bytes[patchLocation - 14] << 0 \|␊
547	␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 13] << 8 \|␊
548	␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 12] << 16 \|␊
549	␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 11] << 24);␊
550	␉␉␉// Remove jump␊
551	␉␉␉bytes[patchLocation - 9] = 0x90;␉␉/// Was a jump if supported cpu␊
552	␉␉␉bytes[patchLocation - 8] = 0x90;␉␉// jumped past the panic call, we want to override the panic␊
553	␉␉␉␊
554	␉␉␉bytes[patchLocation - 7] = 0x90;␊
555	␉␉␉bytes[patchLocation - 6] = 0x90;␊
556	␉␉␉␊
557	␉␉␉bytes[patchLocation - 5] = 0xC7;␊
558	␉␉␉bytes[patchLocation - 4] = 0x05;␊
559	␉␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
560	␉␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
561	␉␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
562	␉␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
563	␉␉␉␊
564	␉␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
565	␉␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
566	␉␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
567	␉␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
568	␉␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
569	␉␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
570	␉␉␉␊
571	␉␉␉␊
572	␉␉␉␊
573	␉␉␉//patchLocation = jumpLocation;␊
574	␉␉␉// We now have 14 bytes available for a patch␊
575	␊
576	␉␉}␊
577	␉␉else ␊
578	␉␉{␊
579	␉␉␉// Patching failed, using NOP replacement done initialy␊
580	␉␉}␊
581	␉}␊
582	␉else ␊
583	␉{␊
584	␉␉// Either We were unable to change the jump call due to the function's sctructure␊
585	␉␉// changing, or the user did not request a patch. As such, resort to just ␊
586	␉␉// removing the panic call (using NOP replacement above). Note that the␊
587	␉␉// IntelCPUPM kext may still panic due to the cpu's Model ID not being patched␊
588	␉}␊
589	}␊
590	␊
591	␊
592	/**␊
593	** SleepEnabler.kext replacement (for those that need it)␊
594	** Located the KERN_INVALID_ARGUMENT return and replace it with KERN_SUCCESS␊
595	**/␊
596	void patch_pmCPUExitHaltToOff(void* kernelData)␊
597	{␊
598	␉UInt8* bytes = (UInt8*)kernelData;␊
599	␊
600	␉kernSymbols_t *symbol = lookup_kernel_symbol("_PmCpuExitHaltToOff");␊
601	␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0;␊
602	␉␊
603	␉if(symbol == 0 \|\| symbol->addr == 0)␊
604	␉{␊
605	␉␉printf("Unable to locate _pmCPUExitHaltToOff\n");␊
606	␉␉return;␊
607	␉}␊
608	␉␊
609	␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
610	␉␊
611	␉␊
612	␉␊
613	␉while(bytes[patchLocation - 1]␉!= 0xB8 \|\|␊
614	␉␉ bytes[patchLocation]␉␉!= 0x04 \|\|␉// KERN_INVALID_ARGUMENT (0x00000004)␊
615	␉␉ bytes[patchLocation + 1]␉!= 0x00 \|\|␉// KERN_INVALID_ARGUMENT␊
616	␉␉ bytes[patchLocation + 2]␉!= 0x00 \|\|␉// KERN_INVALID_ARGUMENT␊
617	␉␉ bytes[patchLocation + 3]␉!= 0x00)␉// KERN_INVALID_ARGUMENT␊
618	␊
619	␉{␊
620	␉␉patchLocation++;␊
621	␉}␊
622	␉bytes[patchLocation] = 0x00;␉// KERN_SUCCESS;␊
623	}␊
624	␊
625	void patch_lapic_init(void* kernelData)␊
626	{␊
627	␉UInt8 panicIndex = 0;␊
628	␉UInt8* bytes = (UInt8*)kernelData;␊
629	␉␊
630	␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_init");␊
631	␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; ␊
632	␉if(symbol == 0 \|\| symbol->addr == 0)␊
633	␉{␊
634	␉␉printf("Unable to locate %s\n", "_lapic_init");␊
635	␉␉return;␊
636	␉␉␊
637	␉}␊
638	␉␊
639	␉symbol = lookup_kernel_symbol("_panic");␊
640	␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; ␊
641	␉if(symbol == 0 \|\| symbol->addr == 0)␊
642	␉{␊
643	␉␉printf("Unable to locate %s\n", "_panic");␊
644	␉␉return;␊
645	␉}␊
646	␉␊
647	␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
648	␉panicAddr -= (UInt32)kernelData;␉// Remove offset␊
649	␊
650	␉␊
651	␉␊
652	␉␊
653	␉// Locate the (panicIndex + 1) panic call␊
654	␉while(panicIndex < 3)␉// Find the third panic call␊
655	␉{␊
656	␉␉while( ␊
657	␉␉␉ (bytes[patchLocation -1] != 0xE8) \|\|␊
658	␉␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 \| ␊
659	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 \| ␊
660	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 \|␊
661	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
662	␉␉␉ )␊
663	␉␉{␊
664	␉␉␉patchLocation++;␊
665	␉␉}␊
666	␉␉patchLocation++;␊
667	␉␉panicIndex++;␊
668	␉}␊
669	␉patchLocation--;␉// Remove extra increment from the < 3 while loop␊
670	␉␊
671	␉bytes[--patchLocation] = 0x90;␉␊
672	␉bytes[++patchLocation] = 0x90;␊
673	␉bytes[++patchLocation] = 0x90;␊
674	␉bytes[++patchLocation] = 0x90;␊
675	␉bytes[++patchLocation] = 0x90;␊
676	␉␊
677	␉␊
678	}␊
679	␊
680	␊
681	void patch_commpage_stuff_routine(void* kernelData)␊
682	{␊
683	␉UInt8* bytes = (UInt8*)kernelData;␊
684	␊
685	␉kernSymbols_t *symbol = lookup_kernel_symbol("_commpage_stuff_routine");␊
686	␉if(symbol == 0 \|\| symbol->addr == 0)␊
687	␉{␊
688	␉␉//printf("Unable to locate %s\n", "_commpage_stuff_routine");␊
689	␉␉return;␊
690	␉␉␊
691	␉}␊
692	␉␊
693	␉UInt32 patchLocation = symbol->addr - textAddress + textSection; ␊
694	␊
695	␉␊
696	␉symbol = lookup_kernel_symbol("_panic");␊
697	␉if(symbol == 0 \|\| symbol->addr == 0)␊
698	␉{␊
699	␉␉printf("Unable to locate %s\n", "_panic");␊
700	␉␉return;␊
701	␉}␊
702	␉UInt32 panicAddr = symbol->addr - textAddress; ␊
703	␊
704	␉patchLocation -= (UInt32)kernelData;␊
705	␉panicAddr -= (UInt32)kernelData;␊
706	␉␊
707	␉while( ␊
708	␉␉ (bytes[patchLocation -1] != 0xE8) \|\|␊
709	␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 \| ␊
710	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 \| ␊
711	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 \|␊
712	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
713	␉␉ )␊
714	␉{␊
715	␉␉patchLocation++;␊
716	␉}␊
717	␉patchLocation--;␊
718	␉␊
719	␉// Replace panic with nops␊
720	␉bytes[patchLocation + 0] = 0x90;␊
721	␉bytes[patchLocation + 1] = 0x90;␊
722	␉bytes[patchLocation + 2] = 0x90;␊
723	␉bytes[patchLocation + 3] = 0x90;␊
724	␉bytes[patchLocation + 4] = 0x90;␊
725	␉␊
726	␉␊
727	}␊
728	␊
729	void patch_lapic_interrupt(void* kernelData)␊
730	{␊
731	␉// NOTE: this is a hack untill I finish patch_lapic_configure␊
732	␉UInt8* bytes = (UInt8*)kernelData;␊
733	␉␊
734	␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_interrupt");␊
735	␉if(symbol == 0 \|\| symbol->addr == 0)␊
736	␉{␊
737	␉␉printf("Unable to locate %s\n", "_lapic_interrupt");␊
738	␉␉return;␊
739	␉␉␊
740	␉}␊
741	␉␊
742	␉UInt32 patchLocation = symbol->addr - textAddress + textSection; ␊
743	␉␊
744	␉␊
745	␉symbol = lookup_kernel_symbol("_panic");␊
746	␉if(symbol == 0 \|\| symbol->addr == 0)␊
747	␉{␊
748	␉␉printf("Unable to locate %s\n", "_panic");␊
749	␉␉return;␊
750	␉}␊
751	␉UInt32 panicAddr = symbol->addr - textAddress; ␊
752	␉␊
753	␉patchLocation -= (UInt32)kernelData;␊
754	␉panicAddr -= (UInt32)kernelData;␊
755	␉␊
756	␉while( ␊
757	␉␉ (bytes[patchLocation -1] != 0xE8) \|\|␊
758	␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 \| ␊
759	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 \| ␊
760	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 \|␊
761	␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
762	␉␉ )␊
763	␉{␊
764	␉␉patchLocation++;␊
765	␉}␊
766	␉patchLocation--;␊
767	␉␊
768	␉// Replace panic with nops␊
769	␉bytes[patchLocation + 0] = 0x90;␊
770	␉bytes[patchLocation + 1] = 0x90;␊
771	␉bytes[patchLocation + 2] = 0x90;␊
772	␉bytes[patchLocation + 3] = 0x90;␊
773	␉bytes[patchLocation + 4] = 0x90;␊
774	␉␊
775	␉␊
776	}␊
777	␊
778	␊
779	void patch_lapic_configure(void* kernelData)␊
780	{␊
781	␉UInt8* bytes = (UInt8*)kernelData;␊
782	␉␊
783	␉UInt32 patchLocation;␊
784	␉UInt32 lapicStart;␊
785	␉UInt32 lapicInterruptBase;␊
786	␉␊
787	␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_configure");␊
788	␉if(symbol == 0 \|\| symbol->addr == 0)␊
789	␉{␊
790	␉␉printf("Unable to locate %s\n", "_lapic_configure");␊
791	␉␉return;␊
792	␉}␊
793	␉patchLocation = symbol->addr - textAddress + textSection; ␊
794	␉␊
795	␉symbol = lookup_kernel_symbol("_lapic_start");␊
796	␉if(symbol == 0 \|\| symbol->addr == 0)␊
797	␉{␊
798	␉␉printf("Unable to locate %s\n", "_lapic_start");␊
799	␉␉return;␊
800	␉}␊
801	␉lapicStart = symbol->addr; ␊
802	␊
803	␊
804	␉symbol = lookup_kernel_symbol("_lapic_interrupt_base");␊
805	␉if(symbol == 0 \|\| symbol->addr == 0)␊
806	␉{␊
807	␉␉printf("Unable to locate %s\n", "_lapic_interrupt_base");␊
808	␉␉return;␊
809	␉}␊
810	␉lapicInterruptBase = symbol->addr;␊
811	␉patchLocation -= (UInt32)kernelData;␊
812	␉lapicStart -= (UInt32)kernelData;␊
813	␉lapicInterruptBase -= (UInt32)kernelData;␊
814	␉␊
815	␉␊
816	␉// Looking for the following:␊
817	␉//movl _lapic_start,%e_x␊
818	␉//addl $0x00000320,%e_x␊
819	␉// 8b 15 __ __ __ __ 81 c2 20 03 00 00␊
820	␉while( ␊
821	␉␉ (bytes[patchLocation - 2] != 0x8b) \|\|␊
822	␉␉ //bytes[patchLocation -1] != 0x15) \|\|␉// Register, we don't care what it is␊
823	␉␉ ( lapicStart != (UInt32)(␊
824	␉␉␉␉␉␉␉␉␉(bytes[patchLocation + 0] << 0 \| ␊
825	␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 1] << 8 \| ␊
826	␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 2] << 16 \|␊
827	␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 3] << 24␊
828	␉␉␉␉␉␉␉␉␉)␊
829	␉␉␉␉␉␉␉␉ )␊
830	␉␉ ) \|\| ␊
831	␉␉ (bytes[patchLocation + 4 ] != 0x81) \|\|␊
832	␉␉ //(bytes[patchLocation + 5 ] != 0Cx2) \|\|␉// register␊
833	␉␉ (bytes[patchLocation + 6 ] != 0x20) \|\|␊
834	␉␉ (bytes[patchLocation + 7 ] != 0x03) \|\|␊
835	␉␉ (bytes[patchLocation + 8 ] != 0x00) \|\|␊
836	␉␉ (bytes[patchLocation + 9] != 0x00)␊
837	␊
838	␉␉ )␊
839	␉{␊
840	␉␉patchLocation++;␊
841	␉}␊
842	␉patchLocation-=2;␊
843	␊
844	␉// NOTE: this is currently hardcoded, change it to be more resilient to changes␊
845	␉// At a minimum, I should have this do a cheksup first and if not matching, remove the panic instead.␊
846	␉␊
847	␉// 8b 15 __ __ __ __ -> movl␉␉ _lapic_start,%edx (NOTE: this should already be here)␊
848	␉/*␊
849	␉bytes[patchLocation++] = 0x8B;␊
850	␉bytes[patchLocation++] = 0x15;␊
851	␉bytes[patchLocation++] = (lapicStart & 0x000000FF) >> 0;␊
852	␉bytes[patchLocation++] = (lapicStart & 0x0000FF00) >> 8;␊
853	␉bytes[patchLocation++] = (lapicStart & 0x00FF0000) >> 16;␊
854	␉bytes[patchLocation++] = (lapicStart & 0xFF000000) >> 24;␊
855	␉*/␊
856	␉patchLocation += 6;␊
857	␉␊
858	␉// 81 c2 60 03 00 00 -> addl␉␉ $0x00000320,%edx␊
859	␉/*␊
860	␉bytes[patchLocation++] = 0x81;␊
861	␉bytes[patchLocation++] = 0xC2;␊
862	␉*/␊
863	␉patchLocation += 2;␊
864	␉bytes[patchLocation++] = 0x60;␊
865	␉/*␊
866	␉bytes[patchLocation++];// = 0x03;␊
867	␉bytes[patchLocation++];// = 0x00;␊
868	␉bytes[patchLocation++];// = 0x00;␊
869	␉*/␊
870	␉ patchLocation += 3;␊
871	␊
872	␉// c7 02 00 04 00 00 -> movl␉␉ $0x00000400,(%edx)␊
873	␉bytes[patchLocation++] = 0xC7;␊
874	␉bytes[patchLocation++] = 0x02;␊
875	␉bytes[patchLocation++] = 0x00;␊
876	␉bytes[patchLocation++] = 0x04;␊
877	␉bytes[patchLocation++] = 0x00;␊
878	␉bytes[patchLocation++] = 0x00;␊
879	␉␊
880	␉// 83 ea 40 -> subl␉␉ $0x40,edx␊
881	␉bytes[patchLocation++] = 0x83;␊
882	␉bytes[patchLocation++] = 0xEA;␊
883	␉bytes[patchLocation++] = 0x40;␊
884	␊
885	␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
886	␉bytes[patchLocation++] = 0xA1;␊
887	␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
888	␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
889	␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
890	␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
891	␊
892	␉// 83 c0 0e -> addl␉␉ $0x0e,%eax␊
893	␉bytes[patchLocation++] = 0x83;␊
894	␉bytes[patchLocation++] = 0xC0;␊
895	␉bytes[patchLocation++] = 0x0E;␊
896	␊
897	␉// 89 02 -> movl␉␉ %eax,(%edx)␊
898	␉bytes[patchLocation++] = 0x89;␊
899	␉bytes[patchLocation++] = 0x02;␊
900	␉␊
901	␉// 81c230030000␉␉ addl␉␉ $0x00000330,%edx␊
902	␉bytes[patchLocation++] = 0x81;␊
903	␉bytes[patchLocation++] = 0xC2;␊
904	␉bytes[patchLocation++] = 0x30;␊
905	␉bytes[patchLocation++] = 0x03;␊
906	␉bytes[patchLocation++] = 0x00;␊
907	␉bytes[patchLocation++] = 0x00;␊
908	␉␊
909	␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
910	␉bytes[patchLocation++] = 0xA1;␊
911	␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
912	␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
913	␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
914	␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
915	␉␊
916	␉// 83 c0 0f -> addl␉␉ $0x0f,%eax␊
917	␉bytes[patchLocation++] = 0x83;␊
918	␉bytes[patchLocation++] = 0xC0;␊
919	␉bytes[patchLocation++] = 0x0F;␊
920	␉␊
921	␉// 89 02 -> movl␉␉ %eax,(%edx)␊
922	␉bytes[patchLocation++] = 0x89;␊
923	␉bytes[patchLocation++] = 0x02;␊
924	␉␊
925	␉// 83 ea 10 -> subl␉␉ $0x10,edx␊
926	␉bytes[patchLocation++] = 0x83;␊
927	␉bytes[patchLocation++] = 0xEA;␊
928	␉bytes[patchLocation++] = 0x10;␊
929	␊
930	␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
931	␉bytes[patchLocation++] = 0xA1;␊
932	␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
933	␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
934	␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
935	␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
936	␉␊
937	␉// 83 c0 0c -> addl␉␉ $0x0c,%eax␊
938	␉bytes[patchLocation++] = 0x83;␊
939	␉bytes[patchLocation++] = 0xC0;␊
940	␉bytes[patchLocation++] = 0x0C;␊
941	␊
942	␉// 89 02 -> movl␉␉ %eax,(%edx)␊
943	␉bytes[patchLocation++] = 0x89;␊
944	␉bytes[patchLocation++] = 0x02;␊
945	␊
946	␉// Replace remaining with nops␊
947	␊
948	␊
949	␉bytes[patchLocation++] = 0x90;␊
950	␉bytes[patchLocation++] = 0x90;␊
951	␉bytes[patchLocation++] = 0x90;␊
952	␉bytes[patchLocation++] = 0x90;␊
953	␉//␉bytes[patchLocation++] = 0x90; // double check the lenght of the patch...␊
954	␉//␉bytes[patchLocation++] = 0x90;␊
955	}␊
956

Download this file