Chameleon

Chameleon Svn Source Tree

Root/branches/meklort/i386/modules/KernelPatcher/kernel_patcher.c

Source at commit 597 created 13 years 6 months ago.
By meklort, Fix kernel patcher, TODO: verify that it works on all kernels
1␉/*␊
2 * Copyright (c) 2009-2010 Evan Lojewski. All rights reserved.␊
3 *␊
4 */␊
5␊
6#include "libsaio.h"␊
7#include "kernel_patcher.h"␊
8#include "platform.h"␊
9#include "modules.h"␊
10extern PlatformInfo_t* Platform;␊
11␊
12patchRoutine_t* patches = NULL;␊
13kernSymbols_t* kernelSymbols = NULL;␊
14␊
15␊
16void KernelPatcher_start()␊
17{␊
18␉register_kernel_patch(patch_cpuid_set_info_all, KERNEL_ANY, CPUID_MODEL_UNKNOWN); ␊
19␊
20␉register_kernel_patch(patch_commpage_stuff_routine, KERNEL_ANY, CPUID_MODEL_ANY);␊
21␉␊
22␉register_kernel_patch(patch_lapic_init, KERNEL_ANY, CPUID_MODEL_ANY);␊
23␊
24␉// NOTE: following is currently 32bit only␊
25␉register_kernel_patch(patch_lapic_configure, KERNEL_32, CPUID_MODEL_ANY);␊
26␊
27␉␊
28␉register_kernel_symbol(KERNEL_ANY, "_panic");␊
29␉register_kernel_symbol(KERNEL_ANY, "_cpuid_set_info");␊
30␉register_kernel_symbol(KERNEL_ANY, "_pmCPUExitHaltToOff");␊
31␉register_kernel_symbol(KERNEL_ANY, "_lapic_init");␊
32␉register_kernel_symbol(KERNEL_ANY, "_commpage_stuff_routine");␊
33␊
34␉// lapic_configure symbols␊
35␉register_kernel_symbol(KERNEL_ANY, "_lapic_configure");␊
36␉register_kernel_symbol(KERNEL_ANY, "_lapic_start");␊
37␉register_kernel_symbol(KERNEL_ANY, "_lapic_interrupt_base");␊
38␉␊
39␉// lapic_interrup symbols␊
40␉//register_kernel_patch(patch_lapic_interrupt, KERNEL_ANY, CPUID_MODEL_ANY);␊
41␉//register_kernel_symbol(KERNEL_ANY, "_lapic_interrupt");␊
42␊
43␊
44␉␊
45␉// TODO: register needed symbols␊
46␉␊
47␉␊
48␉register_hook_callback("ExecKernel", &patch_kernel); ␊
49}␊
50␊
51/*␊
52 * Register a kerenl patch␊
53 */␊
54void register_kernel_patch(void* patch, int arch, int cpus)␊
55{␊
56␉// TODO: only insert valid patches based on current cpuid and architecture␊
57␉// AKA, don't at 64bit patches if it's a 32bit only machine␊
58␉patchRoutine_t* entry;␊
59␉␊
60␉// TODO: verify Platform->CPU.Model is populated this early in bootup␊
61␉// Check to ensure that the patch is valid on this machine␊
62␉// If it is not, exit early form this function␊
63␉if(cpus != Platform->CPU.Model)␊
64␉{␊
65␉␉if(cpus != CPUID_MODEL_ANY)␊
66␉␉{␊
67␉␉␉if(cpus == CPUID_MODEL_UNKNOWN)␊
68␉␉␉{␊
69␉␉␉␉switch(Platform->CPU.Model)␊
70␉␉␉␉{␊
71␉␉␉␉␉case 13:␊
72␉␉␉␉␉case CPUID_MODEL_YONAH:␊
73␉␉␉␉␉case CPUID_MODEL_MEROM:␊
74␉␉␉␉␉case CPUID_MODEL_PENRYN:␊
75␉␉␉␉␉case CPUID_MODEL_NEHALEM:␊
76␉␉␉␉␉case CPUID_MODEL_FIELDS:␊
77␉␉␉␉␉case CPUID_MODEL_DALES:␊
78␉␉␉␉␉case CPUID_MODEL_NEHALEM_EX:␊
79␉␉␉␉␉␉// Known cpu's we don't want to add the patch␊
80␉␉␉␉␉␉return;␊
81␉␉␉␉␉␉break;␊
82␊
83␉␉␉␉␉default:␊
84␉␉␉␉␉␉// CPU not in supported list, so we are going to add␊
85␉␉␉␉␉␉// The patch will be applied␊
86␉␉␉␉␉␉break;␊
87␉␉␉␉␉␉␊
88␉␉␉␉}␊
89␉␉␉}␊
90␉␉␉else␊
91␉␉␉{␊
92␉␉␉␉// Invalid cpuid for current cpu. Ignoring patch␊
93␉␉␉␉return;␊
94␉␉␉}␊
95␊
96␉␉}␊
97␉}␊
98␉␉␊
99␉if(patches == NULL)␊
100␉{␊
101␉␉patches = entry = malloc(sizeof(patchRoutine_t));␊
102␉}␊
103␉else␊
104␉{␊
105␉␉entry = patches;␊
106␉␉while(entry->next)␊
107␉␉{␊
108␉␉␉entry = entry->next;␊
109␉␉}␊
110␉␉␊
111␉␉entry->next = malloc(sizeof(patchRoutine_t));␊
112␉␉entry = entry->next;␊
113␉}␊
114␉␊
115␉entry->next = NULL;␊
116␉entry->patchRoutine = patch;␊
117␉entry->validArchs = arch;␊
118␉entry->validCpu = cpus;␊
119}␊
120␊
121void register_kernel_symbol(int kernelType, const char* name)␊
122{␊
123␉if(kernelSymbols == NULL)␊
124␉{␊
125␉␉kernelSymbols = malloc(sizeof(kernSymbols_t));␊
126␉␉kernelSymbols->next = NULL;␊
127␉␉kernelSymbols->symbol = (char*)name;␊
128␉␉kernelSymbols->addr = 0;␊
129␉}␊
130␉else {␊
131␉␉kernSymbols_t *symbol = kernelSymbols;␊
132␉␉while(symbol->next != NULL)␊
133␉␉{␊
134␉␉␉symbol = symbol->next;␊
135␉␉}␊
136␉␉␊
137␉␉symbol->next = malloc(sizeof(kernSymbols_t));␊
138␉␉symbol = symbol->next;␊
139␊
140␉␉symbol->next = NULL;␊
141␉␉symbol->symbol = (char*)name;␊
142␉␉symbol->addr = 0;␊
143␉}␊
144}␊
145␊
146kernSymbols_t* lookup_kernel_symbol(const char* name)␊
147{␊
148␉kernSymbols_t *symbol = kernelSymbols;␊
149␊
150␉while(symbol && strcmp(symbol->symbol, name) !=0)␊
151␉{␊
152␉␉symbol = symbol->next;␊
153␉}␊
154␉␊
155␉if(!symbol)␊
156␉{␊
157␉␉return NULL;␊
158␉}␊
159␉else␊
160␉{␊
161␉␉return symbol;␊
162␉}␊
163␊
164}␊
165␊
166void patch_kernel(void* kernelData, void* arg2, void* arg3, void *arg4)␊
167{␊
168␉patchRoutine_t* entry = patches;␊
169␊
170␉␊
171␉int arch = determineKernelArchitecture(kernelData);␊
172␊
173␉locate_symbols(kernelData);␊
174␉␊
175␉if(patches != NULL)␊
176␉{␊
177␉␉while(entry)␊
178␉␉{␊
179␉␉␉if(entry->validArchs == KERNEL_ANY || arch == entry->validArchs)␊
180␉␉␉{␊
181␉␉␉␉if(entry->patchRoutine) entry->patchRoutine(kernelData);␊
182␉␉␉}␊
183␉␉␉entry = entry->next;␊
184␉␉}␊
185␉}␊
186}␊
187␊
188int determineKernelArchitecture(void* kernelData)␊
189{␉␊
190␉if(((struct mach_header*)kernelData)->magic == MH_MAGIC)␊
191␉{␊
192␉␉return KERNEL_32;␊
193␉}␊
194␉if(((struct mach_header*)kernelData)->magic == MH_MAGIC_64)␊
195␉{␊
196␉␉return KERNEL_64;␊
197␉}␊
198␉else␊
199␉{␊
200␉␉return KERNEL_ERR;␊
201␉}␊
202}␊
203␊
204␊
205/**␊
206 **␉␉This functions located the requested symbols in the mach-o file.␊
207 **␉␉␉as well as determines the start of the __TEXT segment and __TEXT,__text sections␊
208 **/␊
209int locate_symbols(void* kernelData)␊
210{␊
211␉char is64 = 1;␊
212␉parse_mach(kernelData, NULL, symbol_handler);␊
213␉//handle_symtable((UInt32)kernelData, symtableData, &symbol_handler, determineKernelArchitecture(kernelData) == KERNEL_64);␊
214␉return 1 << is64;␊
215}␊
216␊
217long long symbol_handler(char* symbolName, long long addr, char is64)␊
218{␊
219␉// Locate the symbol in the list, if it exists, update it's address␊
220␉kernSymbols_t *symbol = lookup_kernel_symbol(symbolName);␊
221␉␊
222␉if(symbol)␊
223␉{␊
224␉␉symbol->addr = addr;␊
225␉}␊
226␉␊
227␉return 0xFFFFFFFF; // fixme␊
228}␊
229␊
230␊
231/**␊
232 ** Locate the fisrt instance of _panic inside of _cpuid_set_info, and either remove it␊
233 ** Or replace it so that the cpuid is set to a valid value.␊
234 **/␊
235void patch_cpuid_set_info_all(void* kernelData)␊
236{␊
237␉switch(Platform->CPU.Model)␊
238␉{␊
239␉␉case CPUID_MODEL_ATOM:␊
240␉␉␉if(determineKernelArchitecture(kernelData) == KERNEL_32)␊
241␉␉␉{␊
242␉␉␉␉patch_cpuid_set_info_32(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN); ␊
243␉␉␉}␊
244␉␉␉else ␊
245␉␉␉{␊
246␉␉␉␉patch_cpuid_set_info_64(kernelData, CPUFAMILY_INTEL_PENRYN, CPUID_MODEL_PENRYN); ␊
247␊
248␉␉␉}␊
249␊
250␉␉␉break;␊
251␉␉␉␊
252␉␉default:␊
253␉␉␉if(determineKernelArchitecture(kernelData) == KERNEL_32)␊
254␉␉␉{␊
255␉␉␉␉patch_cpuid_set_info_32(kernelData, 0, 0);␊
256␉␉␉}␊
257␉␉␉else␊
258␉␉␉{␊
259␉␉␉␉patch_cpuid_set_info_64(kernelData, 0, 0);␊
260␉␉␉}␊
261␊
262␉␉␉break;␊
263␉}␊
264}␊
265void patch_cpuid_set_info_64(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
266{␊
267␉UInt8* bytes = (UInt8*)kernelData;␊
268␉␊
269␉kernSymbols_t *symbol = lookup_kernel_symbol("_cpuid_set_info");␊
270␉␊
271␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; //␉(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
272␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
273␉␊
274␉␊
275␉␊
276␉//UInt32 jumpLocation = 0;␊
277␉␊
278␉␊
279␉if(symbol == 0 || symbol->addr == 0)␊
280␉{␊
281␉␉verbose("Unable to locate _cpuid_set_info\n");␊
282␉␉return;␊
283␉␉␊
284␉}␊
285␉␊
286␉symbol = lookup_kernel_symbol("_panic");␊
287␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; //kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
288␉if(symbol == 0 || symbol->addr == 0)␊
289␉{␊
290␉␉printf("Unable to locate _panic\n");␊
291␉␉return;␊
292␉}␊
293␉panicAddr -= (UInt32)kernelData;␊
294␉␊
295␉␊
296␉␊
297␉//TODO: don't assume it'll always work (Look for *next* function address in symtab and fail once it's been reached)␊
298␉while( ␊
299␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
300␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
301␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
302␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
303␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
304␉␉ )␊
305␉{␊
306␉␉patchLocation++;␊
307␉}␊
308␉patchLocation--;␊
309␉␊
310␉// Remove panic just in ca se␊
311␉// The panic instruction is exactly 5 bytes long.␊
312␉bytes[patchLocation + 0] = 0x90;␊
313␉bytes[patchLocation + 1] = 0x90;␊
314␉bytes[patchLocation + 2] = 0x90;␊
315␉bytes[patchLocation + 3] = 0x90;␊
316␉bytes[patchLocation + 4] = 0x90;␊
317␉␊
318␉␊
319␉␊
320␉// Check for a 10.2.0+ kernel␊
321␉if(bytes[patchLocation - 19] == 0xC7 && bytes[patchLocation - 18] == 0x05)␊
322␉{␊
323␉␉␊
324␉␉UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 17] << 0 |␊
325␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 16] << 8 |␊
326␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 15] << 16 |␊
327␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 14] << 24;␊
328␉␉␊
329␉␉// NOTE: may change, determined based on cpuid_info struct␊
330␉␉UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 310; ␊
331␉␉␊
332␉␉␊
333␉␉//ffffff8000228b3b -> 0x00490e8b␊
334␉␉//ffffff8000228c28 -> -237 -> 0x490D9E -> -310␊
335␉␉␊
336␉␉␊
337␉␉// The mov is 10 bytes␊
338␉␉/*␊
339␉␉ bytes[patchLocation - 19] = 0x90;␉// c7␊
340␉␉ bytes[patchLocation - 18] = 0x90;␉// 05␊
341␉␉ bytes[patchLocation - 17] = 0x90;␉// family location␊
342␉␉ bytes[patchLocation - 16] = 0x90;␉// family location␊
343␉␉ bytes[patchLocation - 15] = 0x90;␉// family location␊
344␉␉ bytes[patchLocation - 14] = 0x90;␉// family location␊
345␉␉ */␊
346␉␉bytes[patchLocation - 13] = (impersonateFamily & 0x000000FF) >> 0;␊
347␉␉bytes[patchLocation - 12] = (impersonateFamily & 0x0000FF00) >> 8;␊
348␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
349␉␉bytes[patchLocation - 10] = (impersonateFamily & 0xFF000000) >> 24;␊
350␉␉␊
351␉␉␊
352␉␉// The lea (%rip),%rip is 7 bytes␊
353␉␉bytes[patchLocation - 9] = 0xC7;␊
354␉␉bytes[patchLocation - 8] = 0x05;␊
355␉␉bytes[patchLocation - 7] = ((cpuid_model_addr -10) & 0x000000FF) >> 0;␉// NOTE: this opcode is relative in 64bit mode, subtract offset␊
356␉␉bytes[patchLocation - 6] = ((cpuid_model_addr -10) & 0x0000FF00) >> 8;␉␊
357␉␉bytes[patchLocation - 5] = ((cpuid_model_addr -10) & 0x00FF0000) >> 16;␊
358␉␉bytes[patchLocation - 4] = ((cpuid_model_addr -10) & 0xFF000000) >> 24;␊
359␉␉bytes[patchLocation - 3] = impersonateModel;␉// cpuid_model␊
360␉␉␊
361␉␉ ␊
362␉␉ ␊
363␉␉ // The xor eax eax is 2 bytes␊
364␉␉bytes[patchLocation - 2] = 0x01;␉// cpuid_extmodel␊
365␉␉bytes[patchLocation - 1] = 0x00;␉// cpuid_extfamily␊
366␉␉␊
367␉␉// The panic instruction is exactly 5 bytes long.␊
368␉␉bytes[patchLocation - 0] = 0x02;␉// cpuid_stepping␊
369␉␉/*bytes[patchLocation + 1] = 0x90;␊
370␉␉bytes[patchLocation + 2] = 0x90;␊
371␉␉bytes[patchLocation + 3] = 0x90;␊
372␉␉bytes[patchLocation + 4] = 0x90;␊
373␉␉*/␊
374␉␉␊
375␉␉// Panic call has been removed.␊
376␉␉// Override the CPUID now. This requires ~ 10 bytes on 10.0.0 kernels␊
377␉␉// On 10.2.0+ kernels, this requires ~16 bytes␊
378␉␉␊
379␉␉// Total: 24 bytes␊
380␉␉printf("Running on a 10.2.0+ kernel\n");␊
381␉␉getc();␊
382␊
383␉}␊
384␉else {␊
385␉␉printf("Running on a 10.0.0 kernel, patch unsupported\n");␊
386␉␉getc();␊
387␉}␊
388␊
389␉␊
390}␊
391␊
392␊
393␊
394␊
395␊
396void patch_cpuid_set_info_32(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
397{␊
398␉UInt8* bytes = (UInt8*)kernelData;␊
399␉␊
400␉kernSymbols_t *symbol = lookup_kernel_symbol("_cpuid_set_info");␊
401␊
402␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; //␉(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
403␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
404␉␊
405␉␊
406␊
407␉UInt32 jumpLocation = 0;␊
408␉␊
409␉␊
410␉if(symbol == 0 || symbol->addr == 0)␊
411␉{␊
412␉␉verbose("Unable to locate _cpuid_set_info\n");␊
413␉␉return;␊
414␉␉␊
415␉}␊
416␊
417␉symbol = lookup_kernel_symbol("_panic");␊
418␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; //kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
419␉if(symbol == 0 || symbol->addr == 0)␊
420␉{␊
421␉␉printf("Unable to locate _panic\n");␊
422␉␉return;␊
423␉}␊
424␉panicAddr -= (UInt32)kernelData;␊
425␊
426␉␊
427␉␊
428␉//TODO: don't assume it'll always work (Look for *next* function address in symtab and fail once it's been reached)␊
429␉while( ␊
430␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
431␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
432␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
433␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
434␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
435␉␉ )␊
436␉{␊
437␉␉patchLocation++;␊
438␉}␊
439␉patchLocation--;␊
440␉␊
441␉// Remove panic call, just in case the following patch routines fail␊
442␉bytes[patchLocation + 0] = 0x90;␊
443␉bytes[patchLocation + 1] = 0x90;␊
444␉bytes[patchLocation + 2] = 0x90;␊
445␉bytes[patchLocation + 3] = 0x90;␊
446␉bytes[patchLocation + 4] = 0x90;␊
447␉␊
448␉␊
449␉// Locate the jump call, so that 10 bytes can be reclamed.␊
450␉// NOTE: This will *NOT* be located on pre 10.6.2 kernels␊
451␉jumpLocation = patchLocation - 15;␊
452␉while((bytes[jumpLocation - 1] != 0x77 ||␊
453␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation - 18)) &&␊
454␉␉ (patchLocation - jumpLocation) < 0xF0)␊
455␉{␊
456␉␉jumpLocation--;␊
457␉}␊
458␉// If found... AND we want to impersonate a specific cpumodel / family...␊
459␉if(impersonateFamily && impersonateModel &&␊
460␉ ((patchLocation - jumpLocation) < 0xF0))␊
461␉{␊
462␉␉bytes[jumpLocation] -= 10;␉␉// sizeof(movl␉$0x6b5a4cd2,0x00872eb4) = 10bytes␊
463␉␉␊
464␉␉/* ␊
465␉␉ * Inpersonate the specified CPU FAMILY and CPU Model␊
466␉␉ */␊
467␉␉␊
468␉␉// bytes[patchLocation - 17] = 0xC7;␉// already here... not needed to be done␊
469␉␉// bytes[patchLocation - 16] = 0x05;␉// see above␊
470␉␉UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 15] << 0 |␊
471␉␉bytes[patchLocation - 14] << 8 |␊
472␉␉bytes[patchLocation - 13] << 16 |␊
473␉␉bytes[patchLocation - 12] << 24;␊
474␉␉␊
475␉␉// NOTE: may change, determined based on cpuid_info struct␊
476␉␉UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 299; ␊
477␉␉␊
478␉␉␊
479␉␉// cpufamily␊
480␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x000000FF) >> 0;␊
481␉␉bytes[patchLocation - 10] = (impersonateFamily & 0x0000FF00) >> 8;␊
482␉␉bytes[patchLocation - 9] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
483␉␉bytes[patchLocation - 8] = (impersonateFamily & 0xFF000000) >> 24;␊
484␉␉␊
485␉␉// NOPS, just in case if the jmp call wasn't patched, we'll jump to a␊
486␉␉// nop and continue with the rest of the patch␊
487␉␉// Yay two free bytes :), 10 more can be reclamed if needed, as well as a few␊
488␉␉// from the above code (only cpuid_model needs to be set.␊
489␉␉bytes[patchLocation - 7] = 0x90;␊
490␉␉bytes[patchLocation - 6] = 0x90;␊
491␉␉␊
492␉␉bytes[patchLocation - 5] = 0xC7;␊
493␉␉bytes[patchLocation - 4] = 0x05;␊
494␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
495␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
496␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
497␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
498␉␉␊
499␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
500␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
501␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
502␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
503␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
504␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
505␉␉␊
506␉}␊
507␉else if(impersonateFamily && impersonateModel)␊
508␉{␊
509␊
510␉␉// pre 10.6.2 kernel␊
511␉␉// Locate the jump to directly *after* the panic call,␊
512␉␉jumpLocation = patchLocation - 4;␊
513␉␉while((bytes[jumpLocation - 1] != 0x77 ||␊
514␉␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation + 4)) &&␊
515␉␉␉ (patchLocation - jumpLocation) < 0x20)␊
516␉␉{␊
517␉␉␉jumpLocation--;␊
518␉␉}␊
519␉␉// NOTE above isn't needed (I was going to use it, but I'm not, so instead,␊
520␉␉// I'll just leave it to verify the binary stucture.␊
521␉␉␊
522␉␉// NOTE: the cpumodel_familt data is not set in _cpuid_set_info␊
523␉␉// so we don't need to set it here, I'll get set later based on the model␊
524␉␉// we set now.␊
525␉␉␊
526␉␉if((patchLocation - jumpLocation) < 0x20)␊
527␉␉{␊
528␉␉␉UInt32 cpuid_model_addr =␉(bytes[patchLocation - 14] << 0 |␊
529␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 13] << 8 |␊
530␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 12] << 16 |␊
531␉␉␉␉␉␉␉␉␉␉ bytes[patchLocation - 11] << 24);␊
532␉␉␉// Remove jump␊
533␉␉␉bytes[patchLocation - 9] = 0x90;␉␉/// Was a jump if supported cpu␊
534␉␉␉bytes[patchLocation - 8] = 0x90;␉␉// jumped past the panic call, we want to override the panic␊
535␉␉␉␊
536␉␉␉bytes[patchLocation - 7] = 0x90;␊
537␉␉␉bytes[patchLocation - 6] = 0x90;␊
538␉␉␉␊
539␉␉␉bytes[patchLocation - 5] = 0xC7;␊
540␉␉␉bytes[patchLocation - 4] = 0x05;␊
541␉␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
542␉␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
543␉␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
544␉␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
545␉␉␉␊
546␉␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
547␉␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
548␉␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
549␉␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
550␉␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
551␉␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
552␉␉␉␊
553␉␉␉␊
554␉␉␉␊
555␉␉␉patchLocation = jumpLocation;␊
556␉␉␉// We now have 14 bytes available for a patch␊
557␉␉␉␊
558␉␉}␊
559␉␉else ␊
560␉␉{␊
561␉␉␉// Patching failed, using NOP replacement done initialy␊
562␉␉}␊
563␉}␊
564␉else ␊
565␉{␊
566␉␉// Either We were unable to change the jump call due to the function's sctructure␊
567␉␉// changing, or the user did not request a patch. As such, resort to just ␊
568␉␉// removing the panic call (using NOP replacement above). Note that the␊
569␉␉// IntelCPUPM kext may still panic due to the cpu's Model ID not being patched␊
570␉}␊
571}␊
572␊
573␊
574/**␊
575 ** SleepEnabler.kext replacement (for those that need it)␊
576 ** Located the KERN_INVALID_ARGUMENT return and replace it with KERN_SUCCESS␊
577 **/␊
578void patch_pmCPUExitHaltToOff(void* kernelData)␊
579{␊
580␉UInt8* bytes = (UInt8*)kernelData;␊
581␊
582␉kernSymbols_t *symbol = lookup_kernel_symbol("_PmCpuExitHaltToOff");␊
583␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0;␊
584␉␊
585␉if(symbol == 0 || symbol->addr == 0)␊
586␉{␊
587␉␉printf("Unable to locate _pmCPUExitHaltToOff\n");␊
588␉␉return;␊
589␉}␊
590␉␊
591␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
592␉␊
593␉␊
594␉␊
595␉while(bytes[patchLocation - 1]␉!= 0xB8 ||␊
596␉␉ bytes[patchLocation]␉␉!= 0x04 ||␉// KERN_INVALID_ARGUMENT (0x00000004)␊
597␉␉ bytes[patchLocation + 1]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
598␉␉ bytes[patchLocation + 2]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
599␉␉ bytes[patchLocation + 3]␉!= 0x00)␉// KERN_INVALID_ARGUMENT␊
600␊
601␉{␊
602␉␉patchLocation++;␊
603␉}␊
604␉bytes[patchLocation] = 0x00;␉// KERN_SUCCESS;␊
605}␊
606␊
607void patch_lapic_init(void* kernelData)␊
608{␊
609␉UInt8 panicIndex = 0;␊
610␉UInt8* bytes = (UInt8*)kernelData;␊
611␉␊
612␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_init");␊
613␉UInt32 patchLocation = symbol ? symbol->addr - textAddress + textSection: 0; ␊
614␉if(symbol == 0 || symbol->addr == 0)␊
615␉{␊
616␉␉printf("Unable to locate %s\n", "_lapic_init");␊
617␉␉return;␊
618␉␉␊
619␉}␊
620␉␊
621␉symbol = lookup_kernel_symbol("_panic");␊
622␉UInt32 panicAddr = symbol ? symbol->addr - textAddress: 0; ␊
623␉if(symbol == 0 || symbol->addr == 0)␊
624␉{␊
625␉␉printf("Unable to locate %s\n", "_panic");␊
626␉␉return;␊
627␉}␊
628␉␊
629␉patchLocation -= (UInt32)kernelData;␉// Remove offset␊
630␉panicAddr -= (UInt32)kernelData;␉// Remove offset␊
631␊
632␉␊
633␉␊
634␉␊
635␉// Locate the (panicIndex + 1) panic call␊
636␉while(panicIndex < 3)␉// Find the third panic call␊
637␉{␊
638␉␉while( ␊
639␉␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
640␉␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
641␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
642␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
643␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
644␉␉␉ )␊
645␉␉{␊
646␉␉␉patchLocation++;␊
647␉␉}␊
648␉␉patchLocation++;␊
649␉␉panicIndex++;␊
650␉}␊
651␉patchLocation--;␉// Remove extra increment from the < 3 while loop␊
652␉␊
653␉bytes[--patchLocation] = 0x90;␉␊
654␉bytes[++patchLocation] = 0x90;␊
655␉bytes[++patchLocation] = 0x90;␊
656␉bytes[++patchLocation] = 0x90;␊
657␉bytes[++patchLocation] = 0x90;␊
658␉␊
659␉␊
660}␊
661␊
662␊
663void patch_commpage_stuff_routine(void* kernelData)␊
664{␊
665␉UInt8* bytes = (UInt8*)kernelData;␊
666␊
667␉kernSymbols_t *symbol = lookup_kernel_symbol("_commpage_stuff_routine");␊
668␉if(symbol == 0 || symbol->addr == 0)␊
669␉{␊
670␉␉//printf("Unable to locate %s\n", "_commpage_stuff_routine");␊
671␉␉return;␊
672␉␉␊
673␉}␊
674␉␊
675␉UInt32 patchLocation = symbol->addr - textAddress + textSection; ␊
676␊
677␉␊
678␉symbol = lookup_kernel_symbol("_panic");␊
679␉if(symbol == 0 || symbol->addr == 0)␊
680␉{␊
681␉␉printf("Unable to locate %s\n", "_panic");␊
682␉␉return;␊
683␉}␊
684␉UInt32 panicAddr = symbol->addr - textAddress; ␊
685␊
686␉patchLocation -= (UInt32)kernelData;␊
687␉panicAddr -= (UInt32)kernelData;␊
688␉␊
689␉while( ␊
690␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
691␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
692␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
693␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
694␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
695␉␉ )␊
696␉{␊
697␉␉patchLocation++;␊
698␉}␊
699␉patchLocation--;␊
700␉␊
701␉// Replace panic with nops␊
702␉bytes[patchLocation + 0] = 0x90;␊
703␉bytes[patchLocation + 1] = 0x90;␊
704␉bytes[patchLocation + 2] = 0x90;␊
705␉bytes[patchLocation + 3] = 0x90;␊
706␉bytes[patchLocation + 4] = 0x90;␊
707␉␊
708␉␊
709}␊
710␊
711void patch_lapic_interrupt(void* kernelData)␊
712{␊
713␉// NOTE: this is a hack untill I finish patch_lapic_configure␊
714␉UInt8* bytes = (UInt8*)kernelData;␊
715␉␊
716␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_interrupt");␊
717␉if(symbol == 0 || symbol->addr == 0)␊
718␉{␊
719␉␉printf("Unable to locate %s\n", "_lapic_interrupt");␊
720␉␉return;␊
721␉␉␊
722␉}␊
723␉␊
724␉UInt32 patchLocation = symbol->addr - textAddress + textSection; ␊
725␉␊
726␉␊
727␉symbol = lookup_kernel_symbol("_panic");␊
728␉if(symbol == 0 || symbol->addr == 0)␊
729␉{␊
730␉␉printf("Unable to locate %s\n", "_panic");␊
731␉␉return;␊
732␉}␊
733␉UInt32 panicAddr = symbol->addr - textAddress; ␊
734␉␊
735␉patchLocation -= (UInt32)kernelData;␊
736␉panicAddr -= (UInt32)kernelData;␊
737␉␊
738␉while( ␊
739␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
740␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
741␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
742␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
743␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
744␉␉ )␊
745␉{␊
746␉␉patchLocation++;␊
747␉}␊
748␉patchLocation--;␊
749␉␊
750␉// Replace panic with nops␊
751␉bytes[patchLocation + 0] = 0x90;␊
752␉bytes[patchLocation + 1] = 0x90;␊
753␉bytes[patchLocation + 2] = 0x90;␊
754␉bytes[patchLocation + 3] = 0x90;␊
755␉bytes[patchLocation + 4] = 0x90;␊
756␉␊
757␉␊
758}␊
759␊
760␊
761void patch_lapic_configure(void* kernelData)␊
762{␊
763␉UInt8* bytes = (UInt8*)kernelData;␊
764␉␊
765␉UInt32 patchLocation;␊
766␉UInt32 lapicStart;␊
767␉UInt32 lapicInterruptBase;␊
768␉␊
769␉kernSymbols_t *symbol = lookup_kernel_symbol("_lapic_configure");␊
770␉if(symbol == 0 || symbol->addr == 0)␊
771␉{␊
772␉␉printf("Unable to locate %s\n", "_lapic_configure");␊
773␉␉return;␊
774␉}␊
775␉patchLocation = symbol->addr - textAddress + textSection; ␊
776␉␊
777␉symbol = lookup_kernel_symbol("_lapic_start");␊
778␉if(symbol == 0 || symbol->addr == 0)␊
779␉{␊
780␉␉printf("Unable to locate %s\n", "_lapic_start");␊
781␉␉return;␊
782␉}␊
783␉lapicStart = symbol->addr; ␊
784␊
785␊
786␉symbol = lookup_kernel_symbol("_lapic_interrupt_base");␊
787␉if(symbol == 0 || symbol->addr == 0)␊
788␉{␊
789␉␉printf("Unable to locate %s\n", "_lapic_interrupt_base");␊
790␉␉return;␊
791␉}␊
792␉lapicInterruptBase = symbol->addr;␊
793␉patchLocation -= (UInt32)kernelData;␊
794␉lapicStart -= (UInt32)kernelData;␊
795␉lapicInterruptBase -= (UInt32)kernelData;␊
796␉␊
797␉␊
798␉// Looking for the following:␊
799␉//movl _lapic_start,%e_x␊
800␉//addl $0x00000320,%e_x␊
801␉// 8b 15 __ __ __ __ 81 c2 20 03 00 00␊
802␉while( ␊
803␉␉ (bytes[patchLocation - 2] != 0x8b) ||␊
804␉␉ //bytes[patchLocation -1] != 0x15) ||␉// Register, we don't care what it is␊
805␉␉ ( lapicStart != (UInt32)(␊
806␉␉␉␉␉␉␉␉␉(bytes[patchLocation + 0] << 0 | ␊
807␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 1] << 8 | ␊
808␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 2] << 16 |␊
809␉␉␉␉␉␉␉␉␉ bytes[patchLocation + 3] << 24␊
810␉␉␉␉␉␉␉␉␉)␊
811␉␉␉␉␉␉␉␉ )␊
812␉␉ ) || ␊
813␉␉ (bytes[patchLocation + 4 ] != 0x81) ||␊
814␉␉ //(bytes[patchLocation + 5 ] != 0Cx2) ||␉// register␊
815␉␉ (bytes[patchLocation + 6 ] != 0x20) ||␊
816␉␉ (bytes[patchLocation + 7 ] != 0x03) ||␊
817␉␉ (bytes[patchLocation + 8 ] != 0x00) ||␊
818␉␉ (bytes[patchLocation + 9] != 0x00)␊
819␊
820␉␉ )␊
821␉{␊
822␉␉patchLocation++;␊
823␉}␊
824␉patchLocation-=2;␊
825␊
826␉// NOTE: this is currently hardcoded, change it to be more resilient to changes␊
827␉// At a minimum, I should have this do a cheksup first and if not matching, remove the panic instead.␊
828␉␊
829␉// 8b 15 __ __ __ __ -> movl␉␉ _lapic_start,%edx (NOTE: this should already be here)␊
830␉/*␊
831␉bytes[patchLocation++] = 0x8B;␊
832␉bytes[patchLocation++] = 0x15;␊
833␉bytes[patchLocation++] = (lapicStart & 0x000000FF) >> 0;␊
834␉bytes[patchLocation++] = (lapicStart & 0x0000FF00) >> 8;␊
835␉bytes[patchLocation++] = (lapicStart & 0x00FF0000) >> 16;␊
836␉bytes[patchLocation++] = (lapicStart & 0xFF000000) >> 24;␊
837␉*/␊
838␉patchLocation += 6;␊
839␉␊
840␉// 81 c2 60 03 00 00 -> addl␉␉ $0x00000320,%edx␊
841␉/*␊
842␉bytes[patchLocation++] = 0x81;␊
843␉bytes[patchLocation++] = 0xC2;␊
844␉*/␊
845␉patchLocation += 2;␊
846␉bytes[patchLocation++] = 0x60;␊
847␉/*␊
848␉bytes[patchLocation++];// = 0x03;␊
849␉bytes[patchLocation++];// = 0x00;␊
850␉bytes[patchLocation++];// = 0x00;␊
851␉*/␊
852␉ patchLocation += 3;␊
853␊
854␉// c7 02 00 04 00 00 -> movl␉␉ $0x00000400,(%edx)␊
855␉bytes[patchLocation++] = 0xC7;␊
856␉bytes[patchLocation++] = 0x02;␊
857␉bytes[patchLocation++] = 0x00;␊
858␉bytes[patchLocation++] = 0x04;␊
859␉bytes[patchLocation++] = 0x00;␊
860␉bytes[patchLocation++] = 0x00;␊
861␉␊
862␉// 83 ea 40 -> subl␉␉ $0x40,edx␊
863␉bytes[patchLocation++] = 0x83;␊
864␉bytes[patchLocation++] = 0xEA;␊
865␉bytes[patchLocation++] = 0x40;␊
866␊
867␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
868␉bytes[patchLocation++] = 0xA1;␊
869␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
870␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
871␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
872␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
873␊
874␉// 83 c0 0e -> addl␉␉ $0x0e,%eax␊
875␉bytes[patchLocation++] = 0x83;␊
876␉bytes[patchLocation++] = 0xC0;␊
877␉bytes[patchLocation++] = 0x0E;␊
878␊
879␉// 89 02 -> movl␉␉ %eax,(%edx)␊
880␉bytes[patchLocation++] = 0x89;␊
881␉bytes[patchLocation++] = 0x02;␊
882␉␊
883␉// 81c230030000␉␉ addl␉␉ $0x00000330,%edx␊
884␉bytes[patchLocation++] = 0x81;␊
885␉bytes[patchLocation++] = 0xC2;␊
886␉bytes[patchLocation++] = 0x30;␊
887␉bytes[patchLocation++] = 0x03;␊
888␉bytes[patchLocation++] = 0x00;␊
889␉bytes[patchLocation++] = 0x00;␊
890␉␊
891␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
892␉bytes[patchLocation++] = 0xA1;␊
893␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
894␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
895␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
896␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
897␉␊
898␉// 83 c0 0f -> addl␉␉ $0x0f,%eax␊
899␉bytes[patchLocation++] = 0x83;␊
900␉bytes[patchLocation++] = 0xC0;␊
901␉bytes[patchLocation++] = 0x0F;␊
902␉␊
903␉// 89 02 -> movl␉␉ %eax,(%edx)␊
904␉bytes[patchLocation++] = 0x89;␊
905␉bytes[patchLocation++] = 0x02;␊
906␉␊
907␉// 83 ea 10 -> subl␉␉ $0x10,edx␊
908␉bytes[patchLocation++] = 0x83;␊
909␉bytes[patchLocation++] = 0xEA;␊
910␉bytes[patchLocation++] = 0x10;␊
911␊
912␉// a1 __ __ __ __ -> movl␉␉ _lapic_interrupt_base,%eax␊
913␉bytes[patchLocation++] = 0xA1;␊
914␉bytes[patchLocation++] = (lapicInterruptBase & 0x000000FF) >> 0;␊
915␉bytes[patchLocation++] = (lapicInterruptBase & 0x0000FF00) >> 8;␊
916␉bytes[patchLocation++] = (lapicInterruptBase & 0x00FF0000) >> 16;␊
917␉bytes[patchLocation++] = (lapicInterruptBase & 0xFF000000) >> 24;␊
918␉␊
919␉// 83 c0 0c -> addl␉␉ $0x0c,%eax␊
920␉bytes[patchLocation++] = 0x83;␊
921␉bytes[patchLocation++] = 0xC0;␊
922␉bytes[patchLocation++] = 0x0C;␊
923␊
924␉// 89 02 -> movl␉␉ %eax,(%edx)␊
925␉bytes[patchLocation++] = 0x89;␊
926␉bytes[patchLocation++] = 0x02;␊
927␊
928␉// Replace remaining with nops␊
929␊
930␊
931␉bytes[patchLocation++] = 0x90;␊
932␉bytes[patchLocation++] = 0x90;␊
933␉bytes[patchLocation++] = 0x90;␊
934␉bytes[patchLocation++] = 0x90;␊
935␉//␉bytes[patchLocation++] = 0x90; // double check the lenght of the patch...␊
936␉//␉bytes[patchLocation++] = 0x90;␊
937}␊
938

Archive Download this file

Revision: 597