Chameleon

Chameleon Svn Source Tree

Root/branches/azimutz/Chazileon/i386/boot2/kernel_patcher.c

1/*␊
2 * Copyright (c) 2009 Evan Lojewski. All rights reserved.␊
3 *␊
4 */␊
5␊
6#include "libsaio.h"␊
7#include "kernel_patcher.h"␊
8#include "platform.h"␊
9␊
10extern PlatformInfo_t Platform;␊
11␊
12␊
13#define SYMBOL_CPUID_SET_INFO␉␉␉␉0␊
14#define SYMBOL_PANIC␉␉␉␉␉␉1␊
15#define SYMBOL_PMCPUEXITHALTTOOFF␉␉␉2␊
16#define SYMBOL_LAPIC_INIT␉␉␉␉␉3␊
17#define SYMBOL_COMMPAGE_STUFF_ROUTINE␉␉4 // not needed to boot -legacy :)␊
18#define NUM_SYMBOLS␉␉␉␉␉␉␉5 // change according nr of simbols␊
19␊
20#define SYMBOL_CPUID_SET_INFO_STRING␉␉␉"_cpuid_set_info"␊
21#define SYMBOL_PANIC_STRING␉␉␉␉␉␉"_panic"␊
22#define SYMBOL_PMCPUEXITHALTTOOFF_STRING␉␉"_pmCPUExitHaltToOff"␊
23#define SYMBOL_LAPIC_INIT_STRING␉␉␉␉"_lapic_init"␊
24#define SYMBOL_COMMPAGE_STUFF_ROUTINE_STRING␉"_commpage_stuff_routine"␊
25␊
26char* kernelSymbols[NUM_SYMBOLS] = {␊
27␉SYMBOL_CPUID_SET_INFO_STRING,␊
28␉SYMBOL_PANIC_STRING,␊
29␉SYMBOL_PMCPUEXITHALTTOOFF_STRING,␊
30␉SYMBOL_LAPIC_INIT_STRING,␊
31␉SYMBOL_COMMPAGE_STUFF_ROUTINE_STRING␊
32};␊
33␊
34UInt32 kernelSymbolAddresses[NUM_SYMBOLS] = {␊
35␉0,␊
36␉0,␊
37␉0,␊
38␉0,␊
39␉0␊
40};␊
41␊
42␊
43UInt32 textSection = 0;␊
44UInt32 textAddress = 0;␊
45␊
46␊
47void patch_kernel(void* kernelData)␊
48{␊
49␉switch (locate_symbols((void*)kernelData)) {␊
50␉␉case KERNEL_32:␊
51␉␉␉patch_kernel_32((void*)kernelData);␊
52␉␉␉break;␊
53␉␉␉␊
54␉␉case KERNEL_64:␊
55␉␉default:␊
56␉␉␉patch_kernel_64((void*)kernelData);␊
57␉␉␉break;␊
58␉}␊
59}␊
60␊
61// patches a 64bit kernel.␊
62void patch_kernel_64(void* kernelData)␊
63{␊
64␉// At the moment, the kernel patching code fails when used␊
65␉// in 64bit mode, so we don't patch it. This is due to 32bit vs 64bit␊
66␉// pointers as well as changes in structure sizes␊
67␉printf("Unable to patch 64bit kernel. Please use arch=i386 or -legacy flags.\n");␊
68}␊
69␊
70␊
71/**␊
72 ** patch_kernel_32␊
73 **␉␉patches kernel based on cpu info determined earlier in the boot process.␊
74 **␉␉It the machine is vmware, remove the artificial lapic panic␊
75 **␉␉If the CPU is not supported, remove the cpuid_set_info panic␊
76 **␉␉If the CPU is and Intel Atom, inject the penryn cpuid info.␊
77 **/␊
78void patch_kernel_32(void* kernelData)␊
79{␊
80␉// Remove panic in commpage␊
81␉patch_commpage_stuff_routine(kernelData);␊
82␉␊
83␉//patch_pmCPUExitHaltToOff(kernelData);␉// Not working as intended, disabled for now␊
84␉␊
85␉//␉if(vmware_detected)␊
86␉{␊
87␉␉patch_lapic_init(kernelData);␊
88␉}␊
89␉␊
90␉switch(Platform.CPU.Model)␊
91␉{␊
92␉␉␉// Known good CPU's, no reason to patch kernel␊
93␉␉case 13:␊
94␉␉case CPUID_MODEL_YONAH:␊
95␉␉case CPUID_MODEL_MEROM:␊
96␉␉case CPUID_MODEL_PENRYN:␊
97␉␉case CPUID_MODEL_NEHALEM:␊
98␉␉case CPUID_MODEL_FIELDS:␊
99␉␉case CPUID_MODEL_DALES:␊
100␉␉case CPUID_MODEL_NEHALEM_EX:␊
101␉␉␉break;␊
102␉␉␉␊
103␉␉␉// Known unsuported CPU's␊
104␉␉case CPUID_MODEL_ATOM:␊
105␉␉␉// TODO: Impersonate CPU based on user selection␊
106␉␉␉patch_cpuid_set_info(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN);␉// Impersonate Penryn CPU␊
107␉␉␉break;␊
108␉␉␉␊
109␉␉␉// Unknown CPU's␊
110␉␉default:␉␊
111␉␉␉// TODO: Impersonate CPU based on user selection␊
112␉␉␉//patch_cpuid_set_info(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN); // Impersonate CPU␊
113␉␉␉patch_cpuid_set_info(kernelData, 0, 0);␉// Remove Panic Call␊
114␉␉␉␊
115␉␉␉break;␊
116␉}␊
117}␊
118␊
119␊
120/**␊
121 **␉␉This functions located the kernelSymbols[i] symbols in the mach-o header.␊
122 **␉␉as well as determines the start of the __TEXT segment and __TEXT,__text sections␊
123 **/␊
124int locate_symbols(void* kernelData)␊
125{␊
126␉UInt16 symbolIndexes[NUM_SYMBOLS];␊
127␊
128␉struct load_command *loadCommand;␊
129␉struct symtab_command *symtableData;␊
130␉struct nlist *symbolEntry;␊
131␉␊
132␉char* symbolString;␊
133␊
134␉UInt32 kernelIndex = 0;␊
135␉kernelIndex += sizeof(struct mach_header);␊
136␉␊
137␉if(((struct mach_header*)kernelData)->magic != MH_MAGIC) return KERNEL_64;␊
138␉␊
139␉␊
140␉//printf("%d load commands beginning at 0x%X\n", (unsigned int)header->ncmds, (unsigned int)kernelIndex);␊
141␉//printf("Commands take up %d bytes\n", header->sizeofcmds);␊
142␉␊
143␉␊
144␉int cmd = 0;␊
145␉while(cmd < ((struct mach_header*)kernelData)->ncmds)␉// TODO: for loop instead␊
146␉{␊
147␉␉cmd++;␊
148␉␉␊
149␉␉loadCommand = kernelData + kernelIndex;␊
150␉␉␊
151␉␉UInt cmdSize = loadCommand->cmdsize;␊
152␉␉␊
153␉␉// Locate start of _panic and _cpuid_set_info in the symbol tabe.␊
154␉␉// Load commands should be anded with 0x7FFFFFFF to ignore the␉LC_REQ_DYLD flag␊
155␉␉if((loadCommand->cmd & 0x7FFFFFFF) == LC_SYMTAB)␉␉// We only care about the symtab segment␊
156␉␉{␊
157␉␉␉//printf("Located symtable, length is 0x%X, 0x%X\n", (unsigned int)loadCommand->cmdsize, (unsigned int)sizeof(symtableData));␊
158␉␉␉␊
159␉␉␉symtableData = kernelData + kernelIndex;␊
160␉␉␉kernelIndex += sizeof(struct symtab_command);␊
161␉␉␉␊
162␉␉␉cmdSize -= sizeof(struct symtab_command);␊
163␊
164␉␉␉// Loop through symbol table untill all of the symbols have been found␊
165␉␉␉␊
166␉␉␉symbolString = kernelData + symtableData->stroff; ␊
167␉␉␉␊
168␉␉␉␊
169␉␉␉UInt16 symbolIndex = 0;␊
170␉␉␉UInt8 numSymbolsFound = 0;␊
171␊
172␉␉␉while(symbolIndex < symtableData->nsyms && numSymbolsFound < NUM_SYMBOLS)␉// TODO: for loop␊
173␉␉␉{␊
174␉␉␉␉int i = 0;␊
175␉␉␉␉while(i < NUM_SYMBOLS)␊
176␉␉␉␉{␊
177␉␉␉␉␉if(strcmp(symbolString, kernelSymbols[i]) == 0)␊
178␉␉␉␉␉{␊
179␉␉␉␉␉␉symbolIndexes[i] = symbolIndex;␊
180␉␉␉␉␉␉numSymbolsFound++;␉␉␉␉␊
181␉␉␉␉␉} ␊
182␉␉␉␉␉i++;␊
183␉␉␉␉␉␊
184␉␉␉␉}␊
185␉␉␉␉symbolString += strlen(symbolString) + 1;␊
186␉␉␉␉symbolIndex++;␊
187␉␉␉}␊
188␉␉␉␊
189␉␉␉// loop again␊
190␉␉␉symbolIndex = 0;␊
191␉␉␉numSymbolsFound = 0;␊
192␉␉␉while(symbolIndex < symtableData->nsyms && numSymbolsFound < NUM_SYMBOLS)␉// TODO: for loop␊
193␉␉␉{␊
194␉␉␉␉␊
195␉␉␉␉symbolEntry = kernelData + symtableData->symoff + (symbolIndex * sizeof(struct nlist));␊
196␉␉␉␉␊
197␉␉␉␉int i = 0;␊
198␉␉␉␉while(i < NUM_SYMBOLS)␊
199␉␉␉␉{␊
200␉␉␉␉␉if(symbolIndex == (symbolIndexes[i] - 4))␊
201␉␉␉␉␉{␊
202␉␉␉␉␉␉kernelSymbolAddresses[i] = (UInt32)symbolEntry->n_value;␊
203␉␉␉␉␉␉numSymbolsFound++;␉␉␉␉␊
204␉␉␉␉␉} ␊
205␉␉␉␉␉i++;␊
206␉␉␉␉␉␊
207␉␉␉␉}␊
208␉␉␉␉␊
209␉␉␉␉symbolIndex ++;␊
210␉␉␉}␉␉␉␊
211␉␉// Load commands should be anded with 0x7FFFFFFF to ignore the␉LC_REQ_DYLD flag␊
212␉␉} else if((loadCommand->cmd & 0x7FFFFFFF) == LC_SEGMENT)␉␉// We only care about the __TEXT segment, any other load command can be ignored␊
213␉␉{␊
214␉␉␉␊
215␉␉␉struct segment_command *segCommand;␊
216␉␉␉␊
217␉␉␉segCommand = kernelData + kernelIndex;␊
218␉␉␉␊
219␉␉␉//printf("Segment name is %s\n", segCommand->segname);␊
220␉␉␉␊
221␉␉␉if(strcmp("__TEXT", segCommand->segname) == 0)␊
222␉␉␉{␊
223␉␉␉␉UInt32 sectionIndex;␊
224␉␉␉␉␊
225␉␉␉␉sectionIndex = sizeof(struct segment_command);␊
226␉␉␉␉␊
227␉␉␉␉struct section *sect;␊
228␉␉␉␉␊
229␉␉␉␉while(sectionIndex < segCommand->cmdsize)␊
230␉␉␉␉{␊
231␉␉␉␉␉sect = kernelData + kernelIndex + sectionIndex;␊
232␉␉␉␉␉␊
233␉␉␉␉␉sectionIndex += sizeof(struct section);␊
234␉␉␉␉␉␊
235␉␉␉␉␉␊
236␉␉␉␉␉if(strcmp("__text", sect->sectname) == 0)␊
237␉␉␉␉␉{␊
238␉␉␉␉␉␉// __TEXT,__text found, save the offset and address for when looking for the calls.␊
239␉␉␉␉␉␉textSection = sect->offset;␊
240␉␉␉␉␉␉textAddress = sect->addr;␊
241␉␉␉␉␉␉break;␊
242␉␉␉␉␉}␉␉␉␉␉␊
243␉␉␉␉}␊
244␉␉␉}␊
245␉␉␉␊
246␉␉␉␊
247␉␉␉kernelIndex += cmdSize;␊
248␉␉} else {␊
249␉␉␉kernelIndex += cmdSize;␊
250␉␉}␊
251␉}␊
252␉␊
253␉return KERNEL_32;␊
254}␊
255␊
256␊
257/**␊
258 ** Locate the fisrt instance of _panic inside of _cpuid_set_info, and either remove it␊
259 ** Or replace it so that the cpuid is set to a valid value.␊
260 **/␊
261void patch_cpuid_set_info(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
262{␊
263␉UInt8* bytes = (UInt8*)kernelData;␊
264␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
265␉UInt32 jumpLocation = 0;␊
266␉UInt32 panicAddr = kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
267␉if(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] == 0)␊
268␉{␊
269␉␉printf("Unable to locate _cpuid_set_info\n");␊
270␉␉return;␊
271␉␉␊
272␉}␊
273␉if(kernelSymbolAddresses[SYMBOL_PANIC] == 0)␊
274␉{␊
275␉␉printf("Unable to locate _panic\n");␊
276␉␉return;␊
277␉}␊
278␉␊
279␉//TODO: don't assume it'll always work (Look for *next* function address in symtab and fail once it's been reached)␊
280␉while( ␊
281␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
282␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
283␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
284␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
285␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
286␉␉ )␊
287␉{␊
288␉␉patchLocation++;␊
289␉}␊
290␉patchLocation--;␊
291␉␊
292␉␊
293␉// Remove panic call, just in case the following patch routines fail␊
294␉bytes[patchLocation + 0] = 0x90;␊
295␉bytes[patchLocation + 1] = 0x90;␊
296␉bytes[patchLocation + 2] = 0x90;␊
297␉bytes[patchLocation + 3] = 0x90;␊
298␉bytes[patchLocation + 4] = 0x90;␊
299␉␊
300␉␊
301␉// Locate the jump call, so that 10 bytes can be reclamed.␊
302␉// NOTE: This will *NOT* be located on pre 10.6.2 kernels␊
303␉jumpLocation = patchLocation - 15;␊
304␉while((bytes[jumpLocation - 1] != 0x77 ||␊
305␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation - -8)) &&␊
306␉␉ (patchLocation - jumpLocation) < 0xF0)␊
307␉{␊
308␉␉jumpLocation--;␊
309␉}␊
310␉␊
311␉printf("Mode: %d Family %d P - JMP: 0x%X\n", impersonateModel, impersonateFamily, patchLocation - jumpLocation);␊
312␉// If found... AND we want to impersonate a specific cpumodel / family...␊
313␉if(impersonateFamily &&␊
314␉ impersonateModel &&␊
315␉ ((patchLocation - jumpLocation) < 0xF0))␊
316␉{␊
317␉␉printf("Patching CPUID to %d.%d\n", impersonateFamily, impersonateModel);␊
318␉␉␊
319␉␉bytes[jumpLocation] -= 10;␉␉// sizeof(movl␉$0x6b5a4cd2,0x00872eb4) = 10bytes␊
320␉␉␊
321␉␉/* ␊
322␉␉ * Inpersonate the specified CPU FAMILY and CPU Model␊
323␉␉ */␊
324␊
325␉␉// bytes[patchLocation - 17] = 0xC7;␉// already here... not needed to be done␊
326␉␉// bytes[patchLocation - 16] = 0x05;␉// see above␊
327␉␉UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 15] << 0 |␊
328␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 14] << 8 |␊
329␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 13] << 16 |␊
330␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 12] << 24;␊
331␉␉␊
332␉␉// NOTE: may change, determined based on cpuid_info struct␊
333␉␉UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 299; ␊
334␉␉␊
335␉␉␊
336␉␉// cpufamily = CPUFAMILY_INTEL_PENRYN␊
337␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x000000FF) >> 0;␊
338␉␉bytes[patchLocation - 10] = (impersonateFamily & 0x0000FF00) >> 8;␊
339␉␉bytes[patchLocation - 9] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
340␉␉bytes[patchLocation - 8] = (impersonateFamily & 0xFF000000) >> 24;␊
341␉␉␊
342␉␉// NOPS, just in case if the jmp call wasn't patched, we'll jump to a␊
343␉␉// nop and continue with the rest of the patch␊
344␉␉// Yay two free bytes :), 10 more can be reclamed if needed, as well as a few␊
345␉␉// from the above code (only cpuid_model needs to be set.␊
346␉␉bytes[patchLocation - 7] = 0x90;␊
347␉␉bytes[patchLocation - 6] = 0x90;␊
348␉␉␊
349␉␉bytes[patchLocation - 5] = 0xC7;␊
350␉␉bytes[patchLocation - 4] = 0x05;␊
351␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
352␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
353␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
354␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
355␉␉␊
356␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
357␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
358␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
359␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
360␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
361␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
362␉␉␊
363␉}␊
364␉else if(impersonateFamily && impersonateModel)␊
365␉{␊
366␉␉// pre 10.6.2 kernel␊
367␉␉// Locate the jump to directly *after* the panic call,␊
368␉␉jumpLocation = patchLocation - 4;␊
369␉␉while((bytes[jumpLocation - 1] != 0x77 ||␊
370␉␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation + 4)) &&␊
371␉␉␉ (patchLocation - jumpLocation) < 0x20)␊
372␉␉{␊
373␉␉␉jumpLocation--;␊
374␉␉}␊
375␉␉// NOTE above isn't needed (I was going to use it, but I'm not, so instead,␊
376␉␉// I'll just leave it to verify the binary stucture.␊
377␉␉␊
378␉␉// NOTE: the cpumodel_familt data is not set in _cpuid_set_info␊
379␉␉// so we don't need to set it here, I'll get set later based on the model␊
380␉␉// we set now.␊
381␉␉␊
382␉␉if((patchLocation - jumpLocation) < 0x20)␊
383␉␉{␊
384␉␉␉UInt32 cpuid_model_addr =␉(bytes[patchLocation - 14] << 0 |␊
385␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 13] << 8 |␊
386␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 12] << 16 |␊
387␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 11] << 24);␊
388␉␉␉// Remove jump␊
389␉␉␉bytes[patchLocation - 9] = 0x90;␉␉/// Was a jump if supported cpu␊
390␉␉␉bytes[patchLocation - 8] = 0x90;␉␉// jumped past the panic call, we want to override the panic␊
391␊
392␉␉␉bytes[patchLocation - 7] = 0x90;␊
393␉␉␉bytes[patchLocation - 6] = 0x90;␊
394␉␉␉␊
395␉␉␉bytes[patchLocation - 5] = 0xC7;␊
396␉␉␉bytes[patchLocation - 4] = 0x05;␊
397␉␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
398␉␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
399␉␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
400␉␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
401␉␉␉␊
402␉␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
403␉␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
404␉␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
405␉␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
406␉␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
407␉␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
408␉␉␉␊
409␉␉␉␊
410␉␉␉␊
411␉␉␉patchLocation = jumpLocation;␊
412␉␉␉// We now have 14 bytes available for a patch␊
413␉␉␉␊
414␉␉}␊
415␉␉else ␊
416␉␉{␊
417␉␉␉// Patching failed, using NOP replacement done initialy␊
418␉␉}␊
419␉}␊
420␉else ␊
421␉{␊
422␉␉// Either We were unable to change the jump call due to the function's sctructure␊
423␉␉// changing, or the user did not request a patch. As such, resort to just ␊
424␉␉// removing the panic call (using NOP replacement above). Note that the␊
425␉␉// IntelCPUPM kext may still panic due to the cpu's Model ID not being patched␊
426␉}␊
427}␊
428␊
429␊
430/**␊
431 ** SleepEnabler.kext replacement (for those that need it)␊
432 ** Located the KERN_INVALID_ARGUMENT return and replace it with KERN_SUCCESS␊
433 **/␊
434void patch_pmCPUExitHaltToOff(void* kernelData)␊
435{␊
436␉UInt8* bytes = (UInt8*)kernelData;␊
437␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_PMCPUEXITHALTTOOFF] - textAddress + textSection);␊
438␊
439␉if(kernelSymbolAddresses[SYMBOL_PMCPUEXITHALTTOOFF] == 0)␊
440␉{␊
441␉␉printf("Unable to locate _pmCPUExitHaltToOff\n");␊
442␉␉return;␊
443␉}␊
444␉␊
445␉while(bytes[patchLocation - 1]␉!= 0xB8 ||␊
446␉␉ bytes[patchLocation]␉␉!= 0x04 ||␉// KERN_INVALID_ARGUMENT (0x00000004)␊
447␉␉ bytes[patchLocation + 1]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
448␉␉ bytes[patchLocation + 2]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
449␉␉ bytes[patchLocation + 3]␉!= 0x00)␉// KERN_INVALID_ARGUMENT␊
450␉{␊
451␉␉patchLocation++;␊
452␉}␊
453␉bytes[patchLocation] = 0x00;␉// KERN_SUCCESS;␊
454}␊
455␊
456void patch_lapic_init(void* kernelData)␊
457{␊
458␉UInt8 panicIndex = 0;␊
459␉UInt8* bytes = (UInt8*)kernelData;␊
460␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_LAPIC_INIT] - textAddress + textSection);␊
461␉UInt32 panicAddr = kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
462␊
463␉if(kernelSymbolAddresses[SYMBOL_LAPIC_INIT] == 0)␊
464␉{␊
465␉␉printf("Unable to locate %s\n", SYMBOL_LAPIC_INIT_STRING);␊
466␉␉return;␊
467␉␉␊
468␉}␊
469␉if(kernelSymbolAddresses[SYMBOL_PANIC] == 0)␊
470␉{␊
471␉␉printf("Unable to locate %s\n", SYMBOL_PANIC_STRING);␊
472␉␉return;␊
473␉}␊
474␉␊
475␉␊
476␉␊
477␉// Locate the (panicIndex + 1) panic call␊
478␉while(panicIndex < 3)␉// Find the third panic call␊
479␉{␊
480␉␉while( ␊
481␉␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
482␉␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
483␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
484␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
485␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
486␉␉␉ )␊
487␉␉{␊
488␉␉␉patchLocation++;␊
489␉␉}␊
490␉␉patchLocation++;␊
491␉␉panicIndex++;␊
492␉}␊
493␉patchLocation--;␉// Remove extra increment from the < 3 while loop␊
494␉␊
495␉bytes[--patchLocation] = 0x90;␉␊
496␉bytes[++patchLocation] = 0x90;␊
497␉bytes[++patchLocation] = 0x90;␊
498␉bytes[++patchLocation] = 0x90;␊
499␉bytes[++patchLocation] = 0x90;␊
500␉␊
501␊
502}␊
503␊
504void patch_commpage_stuff_routine(void* kernelData)␊
505{␊
506␉UInt8* bytes = (UInt8*)kernelData;␊
507␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_COMMPAGE_STUFF_ROUTINE] - textAddress + textSection);␊
508␉UInt32 panicAddr = kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
509␉␊
510␉if(kernelSymbolAddresses[SYMBOL_COMMPAGE_STUFF_ROUTINE] == 0)␊
511␉{␊
512␉␉printf("Unable to locate %s\n", SYMBOL_COMMPAGE_STUFF_ROUTINE_STRING);␊
513␉␉return;␊
514␉␉␊
515␉}␊
516␉if(kernelSymbolAddresses[SYMBOL_PANIC] == 0)␊
517␉{␊
518␉␉printf("Unable to locate %s\n", SYMBOL_PANIC_STRING);␊
519␉␉return;␊
520␉}␊
521␉␊
522␉␊
523␉while( ␊
524␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
525␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
526␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
527␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
528␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
529␉␉ )␊
530␉{␊
531␉␉patchLocation++;␊
532␉}␊
533␉patchLocation--;␊
534␉␊
535␉␊
536␉// Remove panic call, just in case the following patch routines fail␊
537␉bytes[patchLocation + 0] = 0x90;␊
538␉bytes[patchLocation + 1] = 0x90;␊
539␉bytes[patchLocation + 2] = 0x90;␊
540␉bytes[patchLocation + 3] = 0x90;␊
541␉bytes[patchLocation + 4] = 0x90;␊
542␉␊
543␉␊
544}␊
545

Archive Download this file

Revision: 296