Chameleon

Chameleon Svn Source Tree

Root/branches/valv/i386/boot2/kernel_patcher.c

1/*␊
2 * Copyright (c) 2009 Evan Lojewski. All rights reserved.␊
3 *␊
4 */␊
5␊
6#include "libsaio.h"␊
7#include "kernel_patcher.h"␊
8#include "platform.h"␊
9␊
10extern PlatformInfo_t Platform;␊
11␊
12␊
13#define SYMBOL_CPUID_SET_INFO␉␉␉␉0␊
14#define SYMBOL_PANIC␉␉␉␉␉␉1␊
15#define SYMBOL_PMCPUEXITHALTTOOFF␉␉␉2␊
16#define SYMBOL_LAPIC_INIT␉␉␉␉␉3␊
17#define SYMBOL_COMMPAGE_STUFF_ROUTINE␉␉4␊
18#define NUM_SYMBOLS␉␉␉␉␉␉␉5␊
19␊
20#define SYMBOL_CPUID_SET_INFO_STRING␉␉"_cpuid_set_info"␊
21#define SYMBOL_PANIC_STRING␉␉␉␉␉"_panic"␊
22#define SYMBOL_PMCPUEXITHALTTOOFF_STRING␉"_pmCPUExitHaltToOff"␊
23#define SYMBOL_LAPIC_INIT_STRING␉␉␉"_lapic_init"␊
24#define SYMBOL_COMMPAGE_STUFF_ROUTINE_STRING␉"_commpage_stuff_routine"␊
25␊
26char* kernelSymbols[NUM_SYMBOLS] = {␊
27␉SYMBOL_CPUID_SET_INFO_STRING,␊
28␉SYMBOL_PANIC_STRING,␊
29␉SYMBOL_PMCPUEXITHALTTOOFF_STRING,␊
30␉SYMBOL_LAPIC_INIT_STRING,␊
31␉SYMBOL_COMMPAGE_STUFF_ROUTINE_STRING␊
32};␊
33␊
34UInt32 kernelSymbolAddresses[NUM_SYMBOLS] = {␊
35␉0,␊
36␉0,␊
37␉0,␊
38␉0,␊
39␉0␊
40};␊
41␊
42␊
43UInt32 textSection = 0;␊
44UInt32 textAddress = 0;␊
45␊
46␊
47void patch_kernel(void* kernelData)␊
48{␊
49␉switch (locate_symbols((void*)kernelData)) {␊
50␉␉case KERNEL_32:␊
51␉␉␉patch_kernel_32((void*)kernelData);␊
52␉␉␉break;␊
53␉␉␉␊
54␉␉case KERNEL_64:␊
55␉␉default:␊
56␉␉␉patch_kernel_64((void*)kernelData);␊
57␉␉␉break;␊
58␉}␊
59}␊
60␊
61// patches a 64bit kernel.␊
62void patch_kernel_64(void* kernelData)␊
63{␊
64␉// At the moment, the kernel patching code fails when used␊
65␉// in 64bit mode, so we don't patch it. This is due to 32bit vs 64bit␊
66␉// pointers as well as changes in structure sizes␊
67␉printf("Unable to patch 64bit kernel. Please use arch=i386.\n");␊
68}␊
69␊
70␊
71/**␊
72 ** patch_kernel_32␊
73 **␉␉patches kernel based on cpu info determined earlier in the boot process.␊
74 **␉␉It the machine is vmware, remove the artificial lapic panic␊
75 **␉␉If the CPU is not supported, remove the cpuid_set_info panic␊
76 **␉␉If the CPU is and Intel Atom, inject the penryn cpuid info.␊
77 **/␊
78void patch_kernel_32(void* kernelData)␊
79{␊
80␉// Remove panic in commpage␊
81␉patch_commpage_stuff_routine(kernelData);␊
82␉␊
83␉//patch_pmCPUExitHaltToOff(kernelData);␉// Not working as intended, disabled for now␊
84␉␊
85␉//␉if(vmware_detected)␊
86␉{␊
87␉␉patch_lapic_init(kernelData);␊
88␉}␊
89␉␊
90␉switch(Platform.CPU.Model)␊
91␉{␊
92␉␉␉// Known good CPU's, no reason to patch kernel␊
93␉␉case 0x0C:␊
94␉␉␉if (strstr(Platform.CPU.BrandString, "Atom")) goto atom;␊
95␉␉case 0x0D:␊
96␉␉case 0x0E:␊
97␉␉case 0x0F:␊
98␉␉case 0x17:␊
99␉␉case 0x1A:␊
100␉␉case 0x1E:␊
101␉␉case 0x1F:␊
102␉␉case 0x2E:␊
103␉␉␉break;␊
104␉␉␉␊
105␉␉␉// Known unsuported CPU's␊
106␉␉case 0x1C:␊
107␉␉case 0x27:␊
108␉␉␉atom:␊
109␉␉␉// TODO: Impersonate CPU based on user selection␊
110␉␉␉patch_cpuid_set_info(kernelData, CPUFAMILY_INTEL_PENRYN, 0x17);␉// Impersonate Penryn CPU␊
111␉␉␉break;␊
112␉␉␉␊
113␉␉␉// Unknown CPU's␊
114␉␉default:␉␊
115␉␉␉// TODO: Impersonate CPU based on user selection␊
116␉␉␉patch_cpuid_set_info(kernelData, 0, 0);␉// Remove Panic Call␊
117␉␉␉break;␊
118␉}␊
119}␊
120␊
121␊
122/**␊
123 **␉␉This functions located the kernelSymbols[i] symbols in the mach-o header.␊
124 **␉␉␉as well as determines the start of the __TEXT segment and __TEXT,__text sections␊
125 **/␊
126int locate_symbols(void* kernelData)␊
127{␊
128␉UInt16 symbolIndexes[NUM_SYMBOLS];␊
129␊
130␉struct load_command *loadCommand;␊
131␉struct symtab_command *symtableData;␊
132␉struct nlist *symbolEntry;␊
133␉␊
134␉char* symbolString;␊
135␊
136␉UInt32 kernelIndex = 0;␊
137␉kernelIndex += sizeof(struct mach_header);␊
138␉␊
139␉if(((struct mach_header*)kernelData)->magic != MH_MAGIC) return KERNEL_64;␊
140␉␊
141␉␊
142␉//printf("%d load commands beginning at 0x%X\n", (unsigned int)header->ncmds, (unsigned int)kernelIndex);␊
143␉//printf("Commands take up %d bytes\n", header->sizeofcmds);␊
144␉␊
145␉␊
146␉int cmd = 0;␊
147␉while(cmd < ((struct mach_header*)kernelData)->ncmds)␉// TODO: for loop instead␊
148␉{␊
149␉␉cmd++;␊
150␉␉␊
151␉␉loadCommand = kernelData + kernelIndex;␊
152␉␉␊
153␉␉UInt cmdSize = loadCommand->cmdsize;␊
154␉␉␊
155␉␉␊
156␉␉// Locate start of _panic and _cpuid_set_info in the symbol tabe.␊
157␉␉// Load commands should be anded with 0x7FFFFFFF to ignore the␉LC_REQ_DYLD flag␊
158␉␉if((loadCommand->cmd & 0x7FFFFFFF) == LC_SYMTAB)␉␉// We only care about the symtab segment␊
159␉␉{␊
160␉␉␉//printf("Located symtable, length is 0x%X, 0x%X\n", (unsigned int)loadCommand->cmdsize, (unsigned int)sizeof(symtableData));␊
161␉␉␉␊
162␉␉␉symtableData = kernelData + kernelIndex;␊
163␉␉␉kernelIndex += sizeof(struct symtab_command);␊
164␉␉␉␊
165␉␉␉cmdSize -= sizeof(struct symtab_command);␊
166␊
167␉␉␉// Loop through symbol table untill all of the symbols have been found␊
168␉␉␉␊
169␉␉␉symbolString = kernelData + symtableData->stroff; ␊
170␉␉␉␊
171␉␉␉␊
172␉␉␉UInt16 symbolIndex = 0;␊
173␉␉␉UInt8 numSymbolsFound = 0;␊
174␊
175␉␉␉while(symbolIndex < symtableData->nsyms && numSymbolsFound < NUM_SYMBOLS)␉// TODO: for loop␊
176␉␉␉{␊
177␉␉␉␉int i = 0;␊
178␉␉␉␉while(i < NUM_SYMBOLS)␊
179␉␉␉␉{␊
180␉␉␉␉␉if(strcmp(symbolString, kernelSymbols[i]) == 0)␊
181␉␉␉␉␉{␊
182␉␉␉␉␉␉symbolIndexes[i] = symbolIndex;␊
183␉␉␉␉␉␉numSymbolsFound++;␉␉␉␉␊
184␉␉␉␉␉} ␊
185␉␉␉␉␉i++;␊
186␉␉␉␉␉␊
187␉␉␉␉}␊
188␉␉␉␉symbolString += strlen(symbolString) + 1;␊
189␉␉␉␉symbolIndex++;␊
190␉␉␉}␊
191␉␉␉␊
192␉␉␉// loop again␊
193␉␉␉symbolIndex = 0;␊
194␉␉␉numSymbolsFound = 0;␊
195␉␉␉while(symbolIndex < symtableData->nsyms && numSymbolsFound < NUM_SYMBOLS)␉// TODO: for loop␊
196␉␉␉{␊
197␉␉␉␉␊
198␉␉␉␉symbolEntry = kernelData + symtableData->symoff + (symbolIndex * sizeof(struct nlist));␊
199␉␉␉␉␊
200␉␉␉␉int i = 0;␊
201␉␉␉␉while(i < NUM_SYMBOLS)␊
202␉␉␉␉{␊
203␉␉␉␉␉if(symbolIndex == (symbolIndexes[i] - 4))␊
204␉␉␉␉␉{␊
205␉␉␉␉␉␉kernelSymbolAddresses[i] = (UInt32)symbolEntry->n_value;␊
206␉␉␉␉␉␉numSymbolsFound++;␉␉␉␉␊
207␉␉␉␉␉} ␊
208␉␉␉␉␉i++;␊
209␉␉␉␉␉␊
210␉␉␉␉}␊
211␉␉␉␉␊
212␉␉␉␉symbolIndex ++;␊
213␉␉␉}␉␉␉␊
214␉␉// Load commands should be anded with 0x7FFFFFFF to ignore the␉LC_REQ_DYLD flag␊
215␉␉} else if((loadCommand->cmd & 0x7FFFFFFF) == LC_SEGMENT)␉␉// We only care about the __TEXT segment, any other load command can be ignored␊
216␉␉{␊
217␉␉␉␊
218␉␉␉struct segment_command *segCommand;␊
219␉␉␉␊
220␉␉␉segCommand = kernelData + kernelIndex;␊
221␉␉␉␊
222␉␉␉//printf("Segment name is %s\n", segCommand->segname);␊
223␉␉␉␊
224␉␉␉if(strcmp("__TEXT", segCommand->segname) == 0)␊
225␉␉␉{␊
226␉␉␉␉UInt32 sectionIndex;␊
227␉␉␉␉␊
228␉␉␉␉sectionIndex = sizeof(struct segment_command);␊
229␉␉␉␉␊
230␉␉␉␉struct section *sect;␊
231␉␉␉␉␊
232␉␉␉␉while(sectionIndex < segCommand->cmdsize)␊
233␉␉␉␉{␊
234␉␉␉␉␉sect = kernelData + kernelIndex + sectionIndex;␊
235␉␉␉␉␉␊
236␉␉␉␉␉sectionIndex += sizeof(struct section);␊
237␉␉␉␉␉␊
238␉␉␉␉␉␊
239␉␉␉␉␉if(strcmp("__text", sect->sectname) == 0)␊
240␉␉␉␉␉{␊
241␉␉␉␉␉␉// __TEXT,__text found, save the offset and address for when looking for the calls.␊
242␉␉␉␉␉␉textSection = sect->offset;␊
243␉␉␉␉␉␉textAddress = sect->addr;␊
244␉␉␉␉␉␉break;␊
245␉␉␉␉␉}␉␉␉␉␉␊
246␉␉␉␉}␊
247␉␉␉}␊
248␉␉␉␊
249␉␉␉␊
250␉␉␉kernelIndex += cmdSize;␊
251␉␉} else {␊
252␉␉␉kernelIndex += cmdSize;␊
253␉␉}␊
254␉}␊
255␉␊
256␉return KERNEL_32;␊
257}␊
258␊
259␊
260/**␊
261 ** Locate the fisrt instance of _panic inside of _cpuid_set_info, and either remove it␊
262 ** Or replace it so that the cpuid is set to a valid value.␊
263 **/␊
264void patch_cpuid_set_info(void* kernelData, UInt32 impersonateFamily, UInt8 impersonateModel)␊
265{␊
266␉UInt8* bytes = (UInt8*)kernelData;␊
267␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] - textAddress + textSection);␊
268␉UInt32 jumpLocation = 0;␊
269␉UInt32 panicAddr = kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
270␉if(kernelSymbolAddresses[SYMBOL_CPUID_SET_INFO] == 0)␊
271␉{␊
272␉␉printf("Unable to locate _cpuid_set_info\n");␊
273␉␉return;␊
274␉␉␊
275␉}␊
276␉if(kernelSymbolAddresses[SYMBOL_PANIC] == 0)␊
277␉{␊
278␉␉printf("Unable to locate _panic\n");␊
279␉␉return;␊
280␉}␊
281␉␊
282␉//TODO: don't assume it'll always work (Look for *next* function address in symtab and fail once it's been reached)␊
283␉while( ␊
284␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
285␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
286␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
287␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
288␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
289␉␉ )␊
290␉{␊
291␉␉patchLocation++;␊
292␉}␊
293␉patchLocation--;␊
294␉␊
295␉␊
296␉// Remove panic call, just in case the following patch routines fail␊
297␉bytes[patchLocation + 0] = 0x90;␊
298␉bytes[patchLocation + 1] = 0x90;␊
299␉bytes[patchLocation + 2] = 0x90;␊
300␉bytes[patchLocation + 3] = 0x90;␊
301␉bytes[patchLocation + 4] = 0x90;␊
302␉␊
303␉␊
304␉// Locate the jump call, so that 10 bytes can be reclamed.␊
305␉// NOTE: This will *NOT* be located on pre 10.6.2 kernels␊
306␉jumpLocation = patchLocation - 15;␊
307␉while((bytes[jumpLocation - 1] != 0x77 ||␊
308␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation - -8)) &&␊
309␉␉ (patchLocation - jumpLocation) < 0xF0)␊
310␉{␊
311␉␉jumpLocation--;␊
312␉}␊
313␉␊
314␉// If found... AND we want to impersonate a specific cpumodel / family...␊
315␉if(impersonateFamily &&␊
316␉ impersonateModel &&␊
317␉ ((patchLocation - jumpLocation) < 0xF0))␊
318␉{␊
319␉␉␊
320␉␉bytes[jumpLocation] -= 10;␉␉// sizeof(movl␉$0x6b5a4cd2,0x00872eb4) = 10bytes␊
321␉␉␊
322␉␉/* ␊
323␉␉ * Inpersonate the specified CPU FAMILY and CPU Model␊
324␉␉ */␊
325␊
326␉␉// bytes[patchLocation - 17] = 0xC7;␉// already here... not needed to be done␊
327␉␉// bytes[patchLocation - 16] = 0x05;␉// see above␊
328␉␉UInt32 cpuid_cpufamily_addr =␉bytes[patchLocation - 15] << 0 |␊
329␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 14] << 8 |␊
330␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 13] << 16 |␊
331␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 12] << 24;␊
332␉␉␊
333␉␉// NOTE: may change, determined based on cpuid_info struct␊
334␉␉UInt32 cpuid_model_addr = cpuid_cpufamily_addr - 299; ␊
335␉␉␊
336␉␉␊
337␉␉// cpufamily = CPUFAMILY_INTEL_PENRYN␊
338␉␉bytes[patchLocation - 11] = (impersonateFamily & 0x000000FF) >> 0;␊
339␉␉bytes[patchLocation - 10] = (impersonateFamily & 0x0000FF00) >> 8;␊
340␉␉bytes[patchLocation - 9] = (impersonateFamily & 0x00FF0000) >> 16;␉␊
341␉␉bytes[patchLocation - 8] = (impersonateFamily & 0xFF000000) >> 24;␊
342␉␉␊
343␉␉// NOPS, just in case if the jmp call wasn't patched, we'll jump to a␊
344␉␉// nop and continue with the rest of the patch␊
345␉␉// Yay two free bytes :), 10 more can be reclamed if needed, as well as a few␊
346␉␉// from the above code (only cpuid_model needs to be set.␊
347␉␉bytes[patchLocation - 7] = 0x90;␊
348␉␉bytes[patchLocation - 6] = 0x90;␊
349␉␉␊
350␉␉bytes[patchLocation - 5] = 0xC7;␊
351␉␉bytes[patchLocation - 4] = 0x05;␊
352␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
353␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
354␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
355␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
356␉␉␊
357␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
358␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
359␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
360␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
361␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
362␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
363␉␉␊
364␉}␊
365␉else if(impersonateFamily && impersonateModel)␊
366␉{␊
367␉␉// pre 10.6.2 kernel␊
368␉␉// Locate the jump to directly *after* the panic call,␊
369␉␉jumpLocation = patchLocation - 4;␊
370␉␉while((bytes[jumpLocation - 1] != 0x77 ||␊
371␉␉␉ bytes[jumpLocation] != (patchLocation - jumpLocation + 4)) &&␊
372␉␉␉ (patchLocation - jumpLocation) < 0x20)␊
373␉␉{␊
374␉␉␉jumpLocation--;␊
375␉␉}␊
376␉␉// NOTE above isn't needed (I was going to use it, but I'm not, so instead,␊
377␉␉// I'll just leave it to verify the binary stucture.␊
378␉␉␊
379␉␉// NOTE: the cpumodel_familt data is not set in _cpuid_set_info␊
380␉␉// so we don't need to set it here, I'll get set later based on the model␊
381␉␉// we set now.␊
382␉␉␊
383␉␉if((patchLocation - jumpLocation) < 0x20)␊
384␉␉{␊
385␉␉␉UInt32 cpuid_model_addr =␉(bytes[patchLocation - 14] << 0 |␊
386␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 13] << 8 |␊
387␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 12] << 16 |␊
388␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation - 11] << 24);␊
389␉␉␉// Remove jump␊
390␉␉␉bytes[patchLocation - 9] = 0x90;␉␉/// Was a jump if supported cpu␊
391␉␉␉bytes[patchLocation - 8] = 0x90;␉␉// jumped past the panic call, we want to override the panic␊
392␊
393␉␉␉bytes[patchLocation - 7] = 0x90;␊
394␉␉␉bytes[patchLocation - 6] = 0x90;␊
395␉␉␉␊
396␉␉␉bytes[patchLocation - 5] = 0xC7;␊
397␉␉␉bytes[patchLocation - 4] = 0x05;␊
398␉␉␉bytes[patchLocation - 3] = (cpuid_model_addr & 0x000000FF) >> 0;␊
399␉␉␉bytes[patchLocation - 2] = (cpuid_model_addr & 0x0000FF00) >> 8;␉␊
400␉␉␉bytes[patchLocation - 1] = (cpuid_model_addr & 0x00FF0000) >> 16;␊
401␉␉␉bytes[patchLocation - 0] = (cpuid_model_addr & 0xFF000000) >> 24;␊
402␉␉␉␊
403␉␉␉// Note: I could have just copied the 8bit cpuid_model in and saved about 4 bytes␊
404␉␉␉// so if this function need a different patch it's still possible. Also, about ten bytes previous can be freed.␊
405␉␉␉bytes[patchLocation + 1] = impersonateModel;␉// cpuid_model␊
406␉␉␉bytes[patchLocation + 2] = 0x01;␉// cpuid_extmodel␊
407␉␉␉bytes[patchLocation + 3] = 0x00;␉// cpuid_extfamily␊
408␉␉␉bytes[patchLocation + 4] = 0x02;␉// cpuid_stepping␊
409␉␉␉␊
410␉␉␉␊
411␉␉␉␊
412␉␉␉patchLocation = jumpLocation;␊
413␉␉␉// We now have 14 bytes available for a patch␊
414␉␉␉␊
415␉␉}␊
416␉␉else ␊
417␉␉{␊
418␉␉␉// Patching failed, using NOP replacement done initialy␊
419␉␉}␊
420␉}␊
421␉else ␊
422␉{␊
423␉␉// Either We were unable to change the jump call due to the function's sctructure␊
424␉␉// changing, or the user did not request a patch. As such, resort to just ␊
425␉␉// removing the panic call (using NOP replacement above). Note that the␊
426␉␉// IntelCPUPM kext may still panic due to the cpu's Model ID not being patched␊
427␉}␊
428}␊
429␊
430␊
431/**␊
432 ** SleepEnabler.kext replacement (for those that need it)␊
433 ** Located the KERN_INVALID_ARGUMENT return and replace it with KERN_SUCCESS␊
434 **/␊
435void patch_pmCPUExitHaltToOff(void* kernelData)␊
436{␊
437␉UInt8* bytes = (UInt8*)kernelData;␊
438␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_PMCPUEXITHALTTOOFF] - textAddress + textSection);␊
439␊
440␉if(kernelSymbolAddresses[SYMBOL_PMCPUEXITHALTTOOFF] == 0)␊
441␉{␊
442␉␉printf("Unable to locate _pmCPUExitHaltToOff\n");␊
443␉␉return;␊
444␉}␊
445␉␊
446␉while(bytes[patchLocation - 1]␉!= 0xB8 ||␊
447␉␉ bytes[patchLocation]␉␉!= 0x04 ||␉// KERN_INVALID_ARGUMENT (0x00000004)␊
448␉␉ bytes[patchLocation + 1]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
449␉␉ bytes[patchLocation + 2]␉!= 0x00 ||␉// KERN_INVALID_ARGUMENT␊
450␉␉ bytes[patchLocation + 3]␉!= 0x00)␉// KERN_INVALID_ARGUMENT␊
451␊
452␉{␊
453␉␉patchLocation++;␊
454␉}␊
455␉bytes[patchLocation] = 0x00;␉// KERN_SUCCESS;␊
456}␊
457␊
458void patch_lapic_init(void* kernelData)␊
459{␊
460␉UInt8 panicIndex = 0;␊
461␉UInt8* bytes = (UInt8*)kernelData;␊
462␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_LAPIC_INIT] - textAddress + textSection);␊
463␉UInt32 panicAddr = kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
464␊
465␉if(kernelSymbolAddresses[SYMBOL_LAPIC_INIT] == 0)␊
466␉{␊
467␉␉printf("Unable to locate %s\n", SYMBOL_LAPIC_INIT_STRING);␊
468␉␉return;␊
469␉␉␊
470␉}␊
471␉if(kernelSymbolAddresses[SYMBOL_PANIC] == 0)␊
472␉{␊
473␉␉printf("Unable to locate %s\n", SYMBOL_PANIC_STRING);␊
474␉␉return;␊
475␉}␊
476␉␊
477␉␊
478␉␊
479␉// Locate the (panicIndex + 1) panic call␊
480␉while(panicIndex < 3)␉// Find the third panic call␊
481␉{␊
482␉␉while( ␊
483␉␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
484␉␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
485␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
486␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
487␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
488␉␉␉ )␊
489␉␉{␊
490␉␉␉patchLocation++;␊
491␉␉}␊
492␉␉patchLocation++;␊
493␉␉panicIndex++;␊
494␉}␊
495␉patchLocation--;␉// Remove extra increment from the < 3 while loop␊
496␉␊
497␉bytes[--patchLocation] = 0x90;␉␊
498␉bytes[++patchLocation] = 0x90;␊
499␉bytes[++patchLocation] = 0x90;␊
500␉bytes[++patchLocation] = 0x90;␊
501␉bytes[++patchLocation] = 0x90;␊
502␉␊
503␉␊
504}␊
505␊
506␊
507void patch_commpage_stuff_routine(void* kernelData)␊
508{␊
509␉UInt8* bytes = (UInt8*)kernelData;␊
510␉UInt32 patchLocation = (kernelSymbolAddresses[SYMBOL_COMMPAGE_STUFF_ROUTINE] - textAddress + textSection);␊
511␉UInt32 panicAddr = kernelSymbolAddresses[SYMBOL_PANIC] - textAddress;␊
512␉␊
513␉if(kernelSymbolAddresses[SYMBOL_COMMPAGE_STUFF_ROUTINE] == 0)␊
514␉{␊
515␉␉printf("Unable to locate %s\n", SYMBOL_COMMPAGE_STUFF_ROUTINE_STRING);␊
516␉␉return;␊
517␉␉␊
518␉}␊
519␉if(kernelSymbolAddresses[SYMBOL_PANIC] == 0)␊
520␉{␊
521␉␉printf("Unable to locate %s\n", SYMBOL_PANIC_STRING);␊
522␉␉return;␊
523␉}␊
524␉␊
525␉␊
526␉while( ␊
527␉␉ (bytes[patchLocation -1] != 0xE8) ||␊
528␉␉ ( ( (UInt32)(panicAddr - patchLocation - 4) + textSection ) != (UInt32)((bytes[patchLocation + 0] << 0 | ␊
529␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 1] << 8 | ␊
530␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 2] << 16 |␊
531␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉␉bytes[patchLocation + 3] << 24)))␊
532␉␉ )␊
533␉{␊
534␉␉patchLocation++;␊
535␉}␊
536␉patchLocation--;␊
537␉␊
538␉␊
539␉// Remove panic call, just in case the following patch routines fail␊
540␉bytes[patchLocation + 0] = 0x90;␊
541␉bytes[patchLocation + 1] = 0x90;␊
542␉bytes[patchLocation + 2] = 0x90;␊
543␉bytes[patchLocation + 3] = 0x90;␊
544␉bytes[patchLocation + 4] = 0x90;␊
545␉␊
546␉␊
547}␊
548

Archive Download this file

Revision: 709