Chameleon

Chameleon Svn Source Tree

Root/branches/meklort/i386/modules/KernelPatcher/kernel_patcher.c

Source at commit 548 created 13 years 7 months ago.
By meklort, Bugfixes (hpet, gui, etc)
1␉/*␊
2 * Copyright (c) 2009-2010 Evan Lojewski. All rights reserved.␊
3 *␊
4 */␊
5␊
6#include "libsaio.h"␊
7#include "kernel_patcher.h"␊
8#include "platform.h"␊
9#include "modules.h"␊
10extern PlatformInfo_t* Platform;␊
11␊
12patchRoutine_t* patches = NULL;␊
13kernSymbols_t* kernelSymbols = NULL;␊
14␊
15␊
16void KernelPatcher_start()␊
17{␊
18␉register_kernel_patch(patch_cpuid_set_info_all, KERNEL_ANY, CPUID_MODEL_UNKNOWN); ␊
19␊
20␉register_kernel_patch(patch_commpage_stuff_routine, KERNEL_ANY, CPUID_MODEL_ANY);␊
21␉␊
22␉register_kernel_patch(patch_lapic_init, KERNEL_ANY, CPUID_MODEL_ANY);␊
23␊
24␉// NOTE: following is currently 32bit only␊
25␉register_kernel_patch(patch_lapic_configure, KERNEL_32, CPUID_MODEL_ANY);␊
26␊
27␉␊
28␉register_kernel_symbol(KERNEL_ANY, "_panic");␊
29␉register_kernel_symbol(KERNEL_ANY, "_cpuid_set_info");␊
30␉register_kernel_symbol(KERNEL_ANY, "_pmCPUExitHaltToOff");␊
31␉register_kernel_symbol(KERNEL_ANY, "_lapic_init");␊
32␉register_kernel_symbol(KERNEL_ANY, "_commpage_stuff_routine");␊
33␊
34␉// lapic_configure symbols␊
35␉register_kernel_symbol(KERNEL_ANY, "_lapic_configure");␊
36␉register_kernel_symbol(KERNEL_ANY, "_lapic_start");␊
37␉register_kernel_symbol(KERNEL_ANY, "_lapic_interrupt_base");␊
38␉␊
39␉// lapic_interrup symbols␊
40␉//register_kernel_patch(patch_lapic_interrupt, KERNEL_ANY, CPUID_MODEL_ANY);␊
41␉//register_kernel_symbol(KERNEL_ANY, "_lapic_interrupt");␊
42␊
43␊
44␉␊
45␉// TODO: register needed symbols␊
46␉␊
47␉␊
48␉register_hook_callback("ExecKernel", &patch_kernel); ␊
49}␊
50␊
51/*␊
52 * Register a kerenl patch␊
53 */␊
54void register_kernel_patch(void* patch, int arch, int cpus)␊
55{␊
56␉// TODO: only insert valid patches based on current cpuid and architecture␊
57␉// AKA, don't at 64bit patches if it's a 32bit only machine␊
58␉patchRoutine_t* entry;␊
59␉␊
60␉// TODO: verify Platform->CPU.Model is populated this early in bootup␊
61␉// Check to ensure that the patch is valid on this machine␊
62␉// If it is not, exit early form this function␊
63␉if(cpus != Platform->CPU.Model)␊
64␉{␊
65␉␉if(cpus != CPUID_MODEL_ANY)␊
66␉␉{␊
67␉␉␉if(cpus == CPUID_MODEL_UNKNOWN)␊
68␉␉␉{␊
69␉␉␉␉switch(Platform->CPU.Model)␊
70␉␉␉␉{␊
71␉␉␉␉␉case 13:␊
72␉␉␉␉␉case CPUID_MODEL_YONAH:␊
73␉␉␉␉␉case CPUID_MODEL_MEROM:␊
74␉␉␉␉␉case CPUID_MODEL_PENRYN:␊
75␉␉␉␉␉case CPUID_MODEL_NEHALEM:␊
76␉␉␉␉␉case CPUID_MODEL_FIELDS:␊
77␉␉␉␉␉case CPUID_MODEL_DALES:␊
78␉␉␉␉␉case CPUID_MODEL_NEHALEM_EX:␊
79␉␉␉␉␉␉// Known cpu's we don't want to add the patch␊
80␉␉␉␉␉␉return;␊
81␉␉␉␉␉␉break;␊
82␊
83␉␉␉␉␉default:␊
84␉␉␉␉␉␉// CPU not in supported list, so we are going to add␊
85␉␉␉␉␉␉// The patch will be applied␊
86␉␉␉␉␉␉break;␊
87␉␉␉␉␉␉␊
88␉␉␉␉}␊
89␉␉␉}␊
90␉␉␉else␊
91␉␉␉{␊
92␉␉␉␉// Invalid cpuid for current cpu. Ignoring patch␊
93␉␉␉␉return;␊
94␉␉␉}␊
95␊
96␉␉}␊
97␉}␊
98␉␉␊
99␉if(patches == NULL)␊
100␉{␊
101␉␉patches = entry = malloc(sizeof(patchRoutine_t));␊
102␉}␊
103␉else␊
104␉{␊
105␉␉entry = patches;␊
106␉␉while(entry->next)␊
107␉␉{␊
108␉␉␉entry = entry->next;␊
109␉␉}␊
110␉␉␊
111␉␉entry->next = malloc(sizeof(patchRoutine_t));␊
112␉␉entry = entry->next;␊
113␉}␊
114␉␊
115␉entry->next = NULL;␊
116␉entry->patchRoutine = patch;␊
117␉entry->validArchs = arch;␊
118␉entry->validCpu = cpus;␊
119}␊
120␊
121void register_kernel_symbol(int kernelType, const char* name)␊
122{␊
123␉if(kernelSymbols == NULL)␊
124␉{␊
125␉␉kernelSymbols = malloc(sizeof(kernSymbols_t));␊
126␉␉kernelSymbols->next = NULL;␊
127␉␉kernelSymbols->symbol = (char*)name;␊
128␉␉kernelSymbols->addr = 0;␊
129␉}␊
130␉else {␊
131␉␉kernSymbols_t *symbol = kernelSymbols;␊
132␉␉while(symbol->next != NULL)␊
133␉␉{␊
134␉␉␉symbol = symbol->next;␊
135␉␉}␊
136␉␉␊
137␉␉symbol->next = malloc(sizeof(kernSymbols_t));␊
138␉␉symbol = symbol->next;␊
139␊
140␉␉symbol->next = NULL;␊
141␉␉symbol->symbol = (char*)name;␊
142␉␉symbol->addr = 0;␊
143␉}␊
144}␊
145␊
146kernSymbols_t* lookup_kernel_symbol(const char* name)␊
147{␊
148␉kernSymbols_t *symbol = kernelSymbols;␊
149␊
150␉while(symbol && strcmp(symbol->symbol, name) !=0)␊
151␉{␊
152␉␉symbol = symbol->next;␊
153␉}␊
154␉␊
155␉if(!symbol)␊
156␉{␊
157␉␉return NULL;␊
158␉}␊
159␉else␊
160␉{␊
161␉␉return symbol;␊
162␉}␊
163␊
164}␊
165␊
166void patch_kernel(void* kernelData, void* arg2, void* arg3, void *arg4)␊
167{␊
168␉patchRoutine_t* entry = patches;␊
169␊
170␉␊
171␉int arch = determineKernelArchitecture(kernelData);␊
172␊
173␉locate_symbols(kernelData);␊
174␉␊
175␉if(patches != NULL)␊
176␉{␊
177␉␉while(entry)␊
178␉␉{␊
179␉␉␉if(entry->validArchs == KERNEL_ANY || arch == entry->validArchs)␊
180␉␉␉{␊
181␉␉␉␉if(entry->patchRoutine) entry->patchRoutine(kernelData);␊
182␉␉␉}␊
183␉␉␉entry = entry->next;␊
184␉␉}␊
185␉␉␊
186␉}␊
187}␊
188␊
189int determineKernelArchitecture(void* kernelData)␊
190{␉␊
191␉if(((struct mach_header*)kernelData)->magic == MH_MAGIC)␊
192␉{␊
193␉␉return KERNEL_32;␊
194␉}␊
195␉if(((struct mach_header*)kernelData)->magic == MH_MAGIC_64)␊
196␉{␊
197␉␉return KERNEL_64;␊
198␉}␊
199␉else␊
200␉{␊
201␉␉return KERNEL_ERR;␊
202␉}␊
203}␊
204␊
205␊
206/**␊
207 **␉␉This functions located the requested symbols in the mach-o file.␊
208 **␉␉␉as well as determines the start of the __TEXT segment and __TEXT,__text sections␊
209 **/␊
210int locate_symbols(void* kernelData)␊
211{␊
212␉char is64 = 1;␊
213␉parse_mach(kernelData, NULL, symbol_handler);␊
214␉//handle_symtable((UInt32)kernelData, symtableData, &symbol_handler, determineKernelArchitecture(kernelData) == KERNEL_64);␊
215␉return 1 << is64;␊
216}␊
217␊
218long long symbol_handler(char* symbolName, long long addr, char is64)␊
219{␊
220␉// Locate the symbol in the list, if it exists, update it's address␊
221␉kernSymbols_t *symbol = lookup_kernel_symbol(symbolName);␊
222␉␊
223␉if(symbol)␊
224␉{␊
225␉␉symbol->addr = addr;␊
226␉}␊
227␉␊
228␉return 0xFFFFFFFF; // fixme␊
229}␊
230␊
231␊
232/**␊
233 ** Locate the fisrt instance of _panic inside of _cpuid_set_info, and either remove it␊
234 ** Or replace it so that the cpuid is set to a valid value.␊
235 **/␊
236void patch_cpuid_set_info_all(void* kernelData)␊
237{␊
238␉switch(Platform->CPU.Model)␊
239␉{␊
240␉␉case CPUID_MODEL_ATOM:␊
241␉␉␉if(determineKernelArchitecture(kernelData) == KERNEL_32)␊
242␉␉␉{␊
243␉␉␉␉patch_cpuid_set_info_32(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN); ␊
244␉␉␉}␊
245␉␉␉else ␊
246␉␉␉{␊
247␉␉␉␉patch_cpuid_set_info_64(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN); ␊
248␊
249␉␉␉}␊
250␊
251␉␉␉break;␊
252␉␉␉␊
253␉␉default:␊
254␉␉␉if(determineKernelArchitecture(kernelData) == KERNEL_32)␊
255␉␉␉{␊
256␉␉␉␉patch_cpuid_set_info_32(kernelData, 0, 0);␊
257␉␉␉}␊
258␉␉␉else␊
259␉␉␉{␊
260␉␉␉␉patch_cpuid_set_info_64(kernelData, 0, 0);␊
261␉␉␉}␊
262␊
263␉␉␉break;␊
264␉}␊
265}␊
266void patch_cpuid_set_info_64(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
267{␊
268␉UInt8* bytes = (UInt8*)kernelData;␊
269␉␊
270␉kernSymbols_t *symbol = lookup_kernel_symbol("_cpuid_set_info");␊
271␉␊
272␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; //␉(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
273␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
274␉␊
275␉␊
276␉␊
277␉//UInt32 jumpLocation = 0;␊
278␉␊
279␉␊
280␉if(symbol == 0 || symbol->addr == 0)␊
281␉{␊
282␉␉printf("Unable to locate _cpuid_set_info\n");␊
283␉␉return;␊
284␉␉␊
285␉}␊
286␉␊
287␉symbol = lookup_kernel_symbol("_panic");␊
288␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; //kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
289␉if(symbol == 0 || symbol->addr == 0)␊
290␉{␊
291␉␉printf("Unable to locate _panic\n");␊
292␉␉return;␊
293␉}␊
294␉panicAddr -= (UInt32)kernelData;␊
295␉␊
296␉␊
297␉␊
298␉//TODO: don't assume it'll always work (Look for *next* function address in symtab and fail once it's been reached)␊
299␉while( ␊
300␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
301␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
302␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
303␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
304␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
305␉␉ )␊
306␉{␊
307␉␉patchLocation++;␊
308␉}␊
309␉patchLocation--;␊
310␉␊
311␉// Remove panic just in ca se␊
312␉// The panic instruction is exactly 5 bytes long.␊
313␉bytes[patchLocation + 0] = 0x90;␊
314␉bytes[patchLocation + 1] = 0x90;␊
315␉bytes[patchLocation + 2] = 0x90;␊
316␉bytes[patchLocation + 3] = 0x90;␊
317␉bytes[patchLocation + 4] = 0x90;␊
318␉␊
319␉␊
320␉␊
321␉// Check for a 10.2.0+ kernel␊
322␉if(bytes[patchLocation - 19] == 0xC7 && bytes[patchLocation - 18] == 0x05)␊
323␉{␊
324␉␉␊
325␉␉UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 17] << 0 |␊
326␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 16] << 8 |␊
327␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 15] << 16 |␊
328␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 14] << 24;␊
329␉␉␊
330␉␉// NOTE: may change, determined based on cpuid_info struct␊
331␉␉UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 310; ␊
332␉␉␊
333␉␉␊
334␉␉//ffffff8000228b3b -> 0x00490e8b␊
335␉␉//ffffff8000228c28 -> -237 -> 0x490D9E -> -310␊
336␉␉␊
337␉␉␊
338␉␉// The mov is 10 bytes␊
339␉␉/*␊
340␉␉ bytes[patchLocation - 19] = 0x90;␉// c7␊
341␉␉ bytes[patchLocation - 18] = 0x90;␉// 05␊
342␉␉ bytes[patchLocation - 17] = 0x90;␉// family location␊
343␉␉ bytes[patchLocation - 16] = 0x90;␉// family location␊
344␉␉ bytes[patchLocation - 15] = 0x90;␉// family location␊
345␉␉ bytes[patchLocation - 14] = 0x90;␉// family location␊
346␉␉ */␊
347␉␉bytes[patchLocation - 13] = (impersonateFamily & 0x000000FF) >> 0;␊
348␉␉bytes[patchLocation - 12] = (impersonateFamily & 0x0000FF00) >> 8;␊
349␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
350␉␉bytes[patchLocation - 10] = (impersonateFamily & 0xFF000000) >> 24;␊
351␉␉␊
352␉␉␊
353␉␉// The lea (%rip),%rip is 7 bytes␊
354␉␉bytes[patchLocation - 9] = 0xC7;␊
355␉␉bytes[patchLocation - 8] = 0x05;␊
356␉␉bytes[patchLocation - 7] = ((cpuid_model_addr -10) & 0x000000FF) >> 0;␉// NOTE: this opcode is relative in 64bit mode, subtract offset␊
357␉␉bytes[patchLocation - 6] = ((cpuid_model_addr -10) & 0x0000FF00) >> 8;␉␊
358␉␉bytes[patchLocation - 5] = ((cpuid_model_addr -10) & 0x00FF0000) >> 16;␊
359␉␉bytes[patchLocation - 4] = ((cpuid_model_addr -10) & 0xFF000000) >> 24;␊
360␉␉bytes[patchLocation - 3] = impersonateModel;␉// cpuid_model␊
361␉␉␊
362␉␉ ␊
363␉␉ ␊
364␉␉ // The xor eax eax is 2 bytes␊
365␉␉bytes[patchLocation - 2] = 0x01;␉// cpuid_extmodel␊
366␉␉bytes[patchLocation - 1] = 0x00;␉// cpuid_extfamily␊
367␉␉␊
368␉␉// The panic instruction is exactly 5 bytes long.␊
369␉␉bytes[patchLocation - 0] = 0x02;␉// cpuid_stepping␊
370␉␉/*bytes[patchLocation + 1] = 0x90;␊
371␉␉bytes[patchLocation + 2] = 0x90;␊
372␉␉bytes[patchLocation + 3] = 0x90;␊
373␉␉bytes[patchLocation + 4] = 0x90;␊
374␉␉*/␊
375␉␉␊
376␉␉// Panic call has been removed.␊
377␉␉// Override the CPUID now. This requires ~ 10 bytes on 10.0.0 kernels␊
378␉␉// On 10.2.0+ kernels, this requires ~16 bytes␊
379␉␉␊
380␉␉// Total: 24 bytes␊
381␉␉printf("Running on a 10.2.0+ kernel\n");␊
382␉␉getc();␊
383␊
384␉}␊
385␉else {␊
386␉␉printf("Running on a 10.0.0 kernel, patch unsupported\n");␊
387␉␉getc();␊
388␉}␊
389␊
390␉␊
391}␊
392␊
393␊
394␊
395␊
396␊
397void patch_cpuid_set_info_32(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
398{␉␊
399␉UInt8* bytes = (UInt8*)kernelData;␊
400␉␊
401␉kernSymbols_t *symbol = lookup_kernel_symbol("_cpuid_set_info");␊
402␊
403␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; //␉(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
404␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
405␉␊
406␉␊
407␊
408␉UInt32 jumpLocation = 0;␊
409␉␊
410␉␊
411␉if(symbol == 0 || symbol->addr == 0)␊
412␉{␊
413␉␉printf("Unable to locate _cpuid_set_info\n");␊
414␉␉return;␊
415␉␉␊
416␉}␊
417␊
418␉symbol = lookup_kernel_symbol("_panic");␊
419␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; //kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
420␉if(symbol == 0 || symbol->addr == 0)␊
421␉{␊
422␉␉printf("Unable to locate _panic\n");␊
423␉␉return;␊
424␉}␊
425␉panicAddr -= (UInt32)kernelData;␊
426␊
427␉␊
428␉␊
429␉//TODO: don't assume it'll always work (Look for *next* function address in symtab and fail once it's been reached)␊
430␉while( ␊
431␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
432␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
433␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
434␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
435␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
436␉␉ )␊
437␉{␊
438␉␉patchLocation++;␊
439␉}␊
440␉patchLocation--;␊
441␉␊
442␉// Remove panic call, just in case the following patch routines fail␊
443␉bytes[patchLocation + 0] = 0x90;␊
444␉bytes[patchLocation + 1] = 0x90;␊
445␉bytes[patchLocation + 2] = 0x90;␊
446␉bytes[patchLocation + 3] = 0x90;␊
447␉bytes[patchLocation + 4] = 0x90;␊
448␉␊
449␉␊
450␉// Locate the jump call, so that 10 bytes can be reclamed.␊
451␉// NOTE: This will *NOT* be located on pre 10.6.2 kernels␊
452␉jumpLocation = patchLocation - 15;␊
453␉while((bytes[jumpLocation - 1] != 0x77 ||␊
454␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation - -8)) &&␊
455␉␉ (patchLocation - jumpLocation) < 0xF0)␊
456␉{␊
457␉␉jumpLocation--;␊
458␉}␊
459␉␊
460␉// If found... AND we want to impersonate a specific cpumodel / family...␊
461␉if(impersonateFamily &&␊
462␉ impersonateModel &&␊
463␉ ((patchLocation - jumpLocation) < 0xF0))␊
464␉{␊
465␉␉␊
466␉␉bytes[jumpLocation] -= 10;␉␉// sizeof(movl␉$0x6b5a4cd2,0x00872eb4) = 10bytes␊
467␉␉␊
468␉␉/* ␊
469␉␉ * Inpersonate the specified CPU FAMILY and CPU Model␊
470␉␉ */␊
471␉␉␊
472␉␉// bytes[patchLocation - 17] = 0xC7;␉// already here... not needed to be done␊
473␉␉// bytes[patchLocation - 16] = 0x05;␉// see above␊
474␉␉UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 15] << 0 |␊
475␉␉bytes[patchLocation - 14] << 8 |␊
476␉␉bytes[patchLocation - 13] << 16 |␊
477␉␉bytes[patchLocation - 12] << 24;␊
478␉␉␊
479␉␉// NOTE: may change, determined based on cpuid_info struct␊
480␉␉UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 299; ␊
481␉␉␊
482␉␉␊
483␉␉// cpufamily␊
484␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x000000FF) >> 0;␊
485␉␉bytes[patchLocation - 10] = (impersonateFamily & 0x0000FF00) >> 8;␊
486␉␉bytes[patchLocation - 9] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
487␉␉bytes[patchLocation - 8] = (impersonateFamily & 0xFF000000) >> 24;␊
488␉␉␊
489␉␉// NOPS, just in case if the jmp call wasn't patched, we'll jump to a␊
490␉␉// nop and continue with the rest of the patch␊
491␉␉// Yay two free bytes :), 10 more can be reclamed if needed, as well as a few␊
492␉␉// from the above code (only cpuid_model needs to be set.␊
493␉␉bytes[patchLocation - 7] = 0x90;␊
494␉␉bytes[patchLocation - 6] = 0x90;␊
495␉␉␊
496␉␉bytes[patchLocation - 5] = 0xC7;␊
497␉␉bytes[patchLocation - 4] = 0x05;␊
498␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
499␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
500␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
501␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
502␉␉␊
503␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
504␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
505␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
506␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
507␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
508␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
509␉␉␊
510␉}␊
511␉else if(impersonateFamily && impersonateModel)␊
512␉{␊
513␉␉// pre 10.6.2 kernel␊
514␉␉// Locate the jump to directly *after* the panic call,␊
515␉␉jumpLocation = patchLocation - 4;␊
516␉␉while((bytes[jumpLocation - 1] != 0x77 ||␊
517␉␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation + 4)) &&␊
518␉␉␉ (patchLocation - jumpLocation) < 0x20)␊
519␉␉{␊
520␉␉␉jumpLocation--;␊
521␉␉}␊
522␉␉// NOTE above isn't needed (I was going to use it, but I'm not, so instead,␊
523␉␉// I'll just leave it to verify the binary stucture.␊
524␉␉␊
525␉␉// NOTE: the cpumodel_familt data is not set in _cpuid_set_info␊
526␉␉// so we don't need to set it here, I'll get set later based on the model␊
527␉␉// we set now.␊
528␉␉␊
529␉␉if((patchLocation - jumpLocation) < 0x20)␊
530␉␉{␊
531␉␉␉UInt32 cpuid_model_addr =␉(bytes[patchLocation - 14] << 0 |␊
532␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 13] << 8 |␊
533␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 12] << 16 |␊
534␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 11] << 24);␊
535␉␉␉// Remove jump␊
536␉␉␉bytes[patchLocation - 9] = 0x90;␉␉/// Was a jump if supported cpu␊
537␉␉␉bytes[patchLocation - 8] = 0x90;␉␉// jumped past the panic call, we want to override the panic␊
538␉␉␉␊
539␉␉␉bytes[patchLocation - 7] = 0x90;␊
540␉␉␉bytes[patchLocation - 6] = 0x90;␊
541␉␉␉␊
542␉␉␉bytes[patchLocation - 5] = 0xC7;␊
543␉␉␉bytes[patchLocation - 4] = 0x05;␊
544␉␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
545␉␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
546␉␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
547␉␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
548␉␉␉␊
549␉␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
550␉␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
551␉␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
552␉␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
553␉␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
554␉␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
555␉␉␉␊
556␉␉␉␊
557␉␉␉␊
558␉␉␉patchLocation = jumpLocation;␊
559␉␉␉// We now have 14 bytes available for a patch␊
560␉␉␉␊
561␉␉}␊
562␉␉else ␊
563␉␉{␊
564␉␉␉// Patching failed, using NOP replacement done initialy␊
565␉␉}␊
566␉}␊
567␉else ␊
568␉{␊
569␉␉// Either We were unable to change the jump call due to the function's sctructure␊
570␉␉// changing, or the user did not request a patch. As such, resort to just ␊
571␉␉// removing the panic call (using NOP replacement above). Note that the␊
572␉␉// IntelCPUPM kext may still panic due to the cpu's Model ID not being patched␊
573␉}␊
574}␊
575␊
576␊
577/**␊
578 ** SleepEnabler.kext replacement (for those that need it)␊
579 ** Located the KERN_INVALID_ARGUMENT return and replace it with KERN_SUCCESS␊
580 **/␊
581void patch_pmCPUExitHaltToOff(void* kernelData)␊
582{␊
583␉UInt8* bytes = (UInt8*)kernelData;␊
584␊
585␉kernSymbols_t *symbol = lookup_kernel_symbol("_PmCpuExitHaltToOff");␊
586␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0;␊
587␉␊
588␉if(symbol == 0 || symbol->addr == 0)␊
589␉{␊
590␉␉printf("Unable to locate _pmCPUExitHaltToOff\n");␊
591␉␉return;␊
592␉}␊
593␉␊
594␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
595␉␊
596␉␊
597␉␊
598␉while(bytes[patchLocation - 1]␉!= 0xB8 ||␊
599␉␉ bytes[patchLocation]␉␉!= 0x04 ||␉// KERN_INVALID_ARGUMENT (0x00000004)␊
600␉␉ bytes[patchLocation + 1]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
601␉␉ bytes[patchLocation + 2]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
602␉␉ bytes[patchLocation + 3]␉!= 0x00)␉// KERN_INVALID_ARGUMENT␊
603␊
604␉{␊
605␉␉patchLocation++;␊
606␉}␊
607␉bytes[patchLocation] = 0x00;␉// KERN_SUCCESS;␊
608}␊
609␊
610void patch_lapic_init(void* kernelData)␊
611{␊
612␊
613␉UInt8 panicIndex = 0;␊
614␉UInt8* bytes = (UInt8*)kernelData;␊
615␉␊
616␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_init");␊
617␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; ␊
618␉if(symbol == 0 || symbol->addr == 0)␊
619␉{␊
620␉␉printf("Unable to locate %s\n", "_lapic_init");␊
621␉␉return;␊
622␉␉␊
623␉}␊
624␉␊
625␉symbol = lookup_kernel_symbol("_panic");␊
626␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; ␊
627␉if(symbol == 0 || symbol->addr == 0)␊
628␉{␊
629␉␉printf("Unable to locate %s\n", "_panic");␊
630␉␉return;␊
631␉}␊
632␉␊
633␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
634␉panicAddr -= (UInt32)kernelData;␉// Remove offset␊
635␊
636␉␊
637␉␊
638␉␊
639␉// Locate the (panicIndex + 1) panic call␊
640␉while(panicIndex < 3)␉// Find the third panic call␊
641␉{␊
642␉␉while( ␊
643␉␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
644␉␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
645␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
646␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
647␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
648␉␉␉ )␊
649␉␉{␊
650␉␉␉patchLocation++;␊
651␉␉}␊
652␉␉patchLocation++;␊
653␉␉panicIndex++;␊
654␉}␊
655␉patchLocation--;␉// Remove extra increment from the < 3 while loop␊
656␉␊
657␉bytes[--patchLocation] = 0x90;␉␊
658␉bytes[++patchLocation] = 0x90;␊
659␉bytes[++patchLocation] = 0x90;␊
660␉bytes[++patchLocation] = 0x90;␊
661␉bytes[++patchLocation] = 0x90;␊
662␉␊
663␉␊
664}␊
665␊
666␊
667void patch_commpage_stuff_routine(void* kernelData)␊
668{␊
669␉UInt8* bytes = (UInt8*)kernelData;␊
670␊
671␉kernSymbols_t *symbol = lookup_kernel_symbol("_commpage_stuff_routine");␊
672␉if(symbol == 0 || symbol->addr == 0)␊
673␉{␊
674␉␉//printf("Unable to locate %s\n", "_commpage_stuff_routine");␊
675␉␉return;␊
676␉␉␊
677␉}␊
678␉␊
679␉UInt32 patchLocation = symbol->addr - textAddress + textSection; ␊
680␊
681␉␊
682␉symbol = lookup_kernel_symbol("_panic");␊
683␉if(symbol == 0 || symbol->addr == 0)␊
684␉{␊
685␉␉printf("Unable to locate %s\n", "_panic");␊
686␉␉return;␊
687␉}␊
688␉UInt32 panicAddr = symbol->addr - textAddress; ␊
689␊
690␉patchLocation -= (UInt32)kernelData;␊
691␉panicAddr -= (UInt32)kernelData;␊
692␉␊
693␉while( ␊
694␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
695␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
696␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
697␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
698␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
699␉␉ )␊
700␉{␊
701␉␉patchLocation++;␊
702␉}␊
703␉patchLocation--;␊
704␉␊
705␉// Replace panic with nops␊
706␉bytes[patchLocation + 0] = 0x90;␊
707␉bytes[patchLocation + 1] = 0x90;␊
708␉bytes[patchLocation + 2] = 0x90;␊
709␉bytes[patchLocation + 3] = 0x90;␊
710␉bytes[patchLocation + 4] = 0x90;␊
711␉␊
712␉␊
713}␊
714␊
715void patch_lapic_interrupt(void* kernelData)␊
716{␊
717␉// NOTE: this is a hack untill I finish patch_lapic_configure␊
718␉UInt8* bytes = (UInt8*)kernelData;␊
719␉␊
720␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_interrupt");␊
721␉if(symbol == 0 || symbol->addr == 0)␊
722␉{␊
723␉␉printf("Unable to locate %s\n", "_lapic_interrupt");␊
724␉␉return;␊
725␉␉␊
726␉}␊
727␉␊
728␉UInt32 patchLocation = symbol->addr - textAddress + textSection; ␊
729␉␊
730␉␊
731␉symbol = lookup_kernel_symbol("_panic");␊
732␉if(symbol == 0 || symbol->addr == 0)␊
733␉{␊
734␉␉printf("Unable to locate %s\n", "_panic");␊
735␉␉return;␊
736␉}␊
737␉UInt32 panicAddr = symbol->addr - textAddress; ␊
738␉␊
739␉patchLocation -= (UInt32)kernelData;␊
740␉panicAddr -= (UInt32)kernelData;␊
741␉␊
742␉while( ␊
743␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
744␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
745␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
746␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
747␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
748␉␉ )␊
749␉{␊
750␉␉patchLocation++;␊
751␉}␊
752␉patchLocation--;␊
753␉␊
754␉// Replace panic with nops␊
755␉bytes[patchLocation + 0] = 0x90;␊
756␉bytes[patchLocation + 1] = 0x90;␊
757␉bytes[patchLocation + 2] = 0x90;␊
758␉bytes[patchLocation + 3] = 0x90;␊
759␉bytes[patchLocation + 4] = 0x90;␊
760␉␊
761␉␊
762}␊
763␊
764␊
765void patch_lapic_configure(void* kernelData)␊
766{␊
767␉UInt8* bytes = (UInt8*)kernelData;␊
768␉␊
769␉UInt32 patchLocation;␊
770␉UInt32 lapicStart;␊
771␉UInt32 lapicInterruptBase;␊
772␉␊
773␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_configure");␊
774␉if(symbol == 0 || symbol->addr == 0)␊
775␉{␊
776␉␉printf("Unable to locate %s\n", "_lapic_configure");␊
777␉␉return;␊
778␉}␊
779␉patchLocation = symbol->addr - textAddress + textSection; ␊
780␉␊
781␉symbol = lookup_kernel_symbol("_lapic_start");␊
782␉if(symbol == 0 || symbol->addr == 0)␊
783␉{␊
784␉␉printf("Unable to locate %s\n", "_lapic_start");␊
785␉␉return;␊
786␉}␊
787␉lapicStart = symbol->addr; ␊
788␊
789␊
790␉symbol = lookup_kernel_symbol("_lapic_interrupt_base");␊
791␉if(symbol == 0 || symbol->addr == 0)␊
792␉{␊
793␉␉printf("Unable to locate %s\n", "_lapic_interrupt_base");␊
794␉␉return;␊
795␉}␊
796␉lapicInterruptBase = symbol->addr;␊
797␉patchLocation -= (UInt32)kernelData;␊
798␉lapicStart -= (UInt32)kernelData;␊
799␉lapicInterruptBase -= (UInt32)kernelData;␊
800␉␊
801␉␊
802␉// Looking for the following:␊
803␉//movl _lapic_start,%e_x␊
804␉//addl $0x00000320,%e_x␊
805␉// 8b 15 __ __ __ __ 81 c2 20 03 00 00␊
806␉while( ␊
807␉␉ (bytes[patchLocation - 2] != 0x8b) ||␊
808␉␉ //bytes[patchLocation -1] != 0x15) ||␉// Register, we don't care what it is␊
809␉␉ ( lapicStart != (UInt32)(␊
810␉␉␉␉␉␉␉␉␉(bytes[patchLocation + 0] << 0 | ␊
811␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 1] << 8 | ␊
812␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 2] << 16 |␊
813␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 3] << 24␊
814␉␉␉␉␉␉␉␉␉)␊
815␉␉␉␉␉␉␉␉ )␊
816␉␉ ) || ␊
817␉␉ (bytes[patchLocation + 4 ] != 0x81) ||␊
818␉␉ //(bytes[patchLocation + 5 ] != 0Cx2) ||␉// register␊
819␉␉ (bytes[patchLocation + 6 ] != 0x20) ||␊
820␉␉ (bytes[patchLocation + 7 ] != 0x03) ||␊
821␉␉ (bytes[patchLocation + 8 ] != 0x00) ||␊
822␉␉ (bytes[patchLocation + 9] != 0x00)␊
823␊
824␉␉ )␊
825␉{␊
826␉␉patchLocation++;␊
827␉}␊
828␉patchLocation-=2;␊
829␊
830␉// NOTE: this is currently hardcoded, change it to be more resilient to changes␊
831␉// At a minimum, I should have this do a cheksup first and if not matching, remove the panic instead.␊
832␉␊
833␉// 8b 15 __ __ __ __ -> movl␉␉ _lapic_start,%edx (NOTE: this should already be here)␊
834␉/*␊
835␉bytes[patchLocation++] = 0x8B;␊
836␉bytes[patchLocation++] = 0x15;␊
837␉bytes[patchLocation++] = (lapicStart & 0x000000FF) >> 0;␊
838␉bytes[patchLocation++] = (lapicStart & 0x0000FF00) >> 8;␊
839␉bytes[patchLocation++] = (lapicStart & 0x00FF0000) >> 16;␊
840␉bytes[patchLocation++] = (lapicStart & 0xFF000000) >> 24;␊
841␉*/␊
842␉patchLocation += 6;␊
843␉␊
844␉// 81 c2 60 03 00 00 -> addl␉␉ $0x00000320,%edx␊
845␉/*␊
846␉bytes[patchLocation++] = 0x81;␊
847␉bytes[patchLocation++] = 0xC2;␊
848␉*/␊
849␉patchLocation += 2;␊
850␉bytes[patchLocation++] = 0x60;␊
851␉/*␊
852␉bytes[patchLocation++];// = 0x03;␊
853␉bytes[patchLocation++];// = 0x00;␊
854␉bytes[patchLocation++];// = 0x00;␊
855␉*/␊
856␉ patchLocation += 3;␊
857␊
858␉// c7 02 00 04 00 00 -> movl␉␉ $0x00000400,(%edx)␊
859␉bytes[patchLocation++] = 0xC7;␊
860␉bytes[patchLocation++] = 0x02;␊
861␉bytes[patchLocation++] = 0x00;␊
862␉bytes[patchLocation++] = 0x04;␊
863␉bytes[patchLocation++] = 0x00;␊
864␉bytes[patchLocation++] = 0x00;␊
865␉␊
866␉// 83 ea 40 -> subl␉␉ $0x40,edx␊
867␉bytes[patchLocation++] = 0x83;␊
868␉bytes[patchLocation++] = 0xEA;␊
869␉bytes[patchLocation++] = 0x40;␊
870␊
871␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
872␉bytes[patchLocation++] = 0xA1;␊
873␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
874␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
875␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
876␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
877␊
878␉// 83 c0 0e -> addl␉␉ $0x0e,%eax␊
879␉bytes[patchLocation++] = 0x83;␊
880␉bytes[patchLocation++] = 0xC0;␊
881␉bytes[patchLocation++] = 0x0E;␊
882␊
883␉// 89 02 -> movl␉␉ %eax,(%edx)␊
884␉bytes[patchLocation++] = 0x89;␊
885␉bytes[patchLocation++] = 0x02;␊
886␉␊
887␉// 81c230030000␉␉ addl␉␉ $0x00000330,%edx␊
888␉bytes[patchLocation++] = 0x81;␊
889␉bytes[patchLocation++] = 0xC2;␊
890␉bytes[patchLocation++] = 0x30;␊
891␉bytes[patchLocation++] = 0x03;␊
892␉bytes[patchLocation++] = 0x00;␊
893␉bytes[patchLocation++] = 0x00;␊
894␉␊
895␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
896␉bytes[patchLocation++] = 0xA1;␊
897␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
898␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
899␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
900␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
901␉␊
902␉// 83 c0 0f -> addl␉␉ $0x0f,%eax␊
903␉bytes[patchLocation++] = 0x83;␊
904␉bytes[patchLocation++] = 0xC0;␊
905␉bytes[patchLocation++] = 0x0F;␊
906␉␊
907␉// 89 02 -> movl␉␉ %eax,(%edx)␊
908␉bytes[patchLocation++] = 0x89;␊
909␉bytes[patchLocation++] = 0x02;␊
910␉␊
911␉// 83 ea 10 -> subl␉␉ $0x10,edx␊
912␉bytes[patchLocation++] = 0x83;␊
913␉bytes[patchLocation++] = 0xEA;␊
914␉bytes[patchLocation++] = 0x10;␊
915␊
916␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
917␉bytes[patchLocation++] = 0xA1;␊
918␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
919␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
920␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
921␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
922␉␊
923␉// 83 c0 0c -> addl␉␉ $0x0c,%eax␊
924␉bytes[patchLocation++] = 0x83;␊
925␉bytes[patchLocation++] = 0xC0;␊
926␉bytes[patchLocation++] = 0x0C;␊
927␊
928␉// 89 02 -> movl␉␉ %eax,(%edx)␊
929␉bytes[patchLocation++] = 0x89;␊
930␉bytes[patchLocation++] = 0x02;␊
931␊
932␉// Replace remaining with nops␊
933␊
934␊
935␉bytes[patchLocation++] = 0x90;␊
936␉bytes[patchLocation++] = 0x90;␊
937␉bytes[patchLocation++] = 0x90;␊
938␉bytes[patchLocation++] = 0x90;␊
939␉//␉bytes[patchLocation++] = 0x90; // double check the lenght of the patch...␊
940␉//␉bytes[patchLocation++] = 0x90;␊
941}␊
942

Archive Download this file

Revision: 548