Chameleon

Chameleon Svn Source Tree

Root/branches/meklort/i386/modules/KextPatcher/kext_patcher.c

Source at commit 717 created 13 years 2 months ago.
By meklort, Module system fixes. Symbols.dylib now contains correct addresses for global symbols. KextPather only tries to patch dev ids with 0x433F or less, reenabled Resolution.dylib
1␉/*␊
2 * Copyright (c) 2010 Evan Lojewski. All rights reserved.␊
3 *␉␊
4 *␉KextPather␊
5 *␉This is an experimental module that I'm looking into implimenting.␊
6 *␉The main purpose is to replace the need for programs such as ␊
7 * NetbookInstaller's kext patching routines. THis way, Apple's kexts can be␊
8 * patched whe loaded instead. (eg: GMA950 kext, Bluetooth + Wifi kexts)␊
9 */␊
10␊
11#include "libsaio.h"␊
12#include "zlib.h"␊
13#include "kext_patcher.h"␊
14#include "boot.h"␊
15#include "bootstruct.h"␊
16#include "pci.h"␊
17#include "drivers.h"␊
18#include "mkext.h"␊
19#include "modules.h"␊
20#include "hex_editor.h"␊
21␊
22␊
23#define kHDACodec␉␉␉␉"HDACodec"␊
24␊
25␊
26#ifndef DEBUG_KEXT_PATCHER␊
27#define DEBUG_KEXT_PATCHER 0␊
28#endif␊
29␊
30#if DEBUG_KEXT_PATCHER␊
31#define DBG(x...)␉printf(x)␊
32#else␊
33#define DBG(x...)␊
34#endif␊
35␊
36␊
37bool patch_kext(TagPtr plist, char* plistbuffer, void* start);␊
38bool patch_gma_kexts(TagPtr plist, char* plistbuffer, void* start);␊
39bool patch_bcm_kext(TagPtr plist, char* plistbuffer, void* start);␊
40bool patch_hda_kext(TagPtr plist, char* plistbuffer, void* start);␊
41bool patch_hda_controller(TagPtr plist, char* plistbuffer, void* start);␊
42␊
43int chartohex(char c);␊
44␊
45static void * z_alloc(void *, u_int items, u_int size);␊
46static void z_free(void *, void *ptr);␊
47␊
48uint16_t patch_gma_deviceid = 0;␊
49uint16_t patch_bcm_deviceid = 0;␊
50␊
51// TODO: add detection code␊
52uint16_t patch_hda_codec = 0x00;␊
53␊
54#define NEEDS_PATCHING␉␉(patch_bcm_deviceid || patch_gma_deviceid || patch_hda_codec)␊
55␊
56typedef struct z_mem {␊
57 uint32_t alloc_size;␊
58 uint8_t data[0];␊
59} z_mem;␊
60␊
61/*␊
62 * Space allocation and freeing routines for use by zlib routines.␊
63 */␊
64void *␊
65z_alloc(void * notused __unused, u_int num_items, u_int size)␊
66{␊
67 void * result = NULL;␊
68 z_mem * zmem = NULL;␊
69 uint32_t total = num_items * size;␊
70 uint32_t allocSize = total + sizeof(zmem);␊
71 ␊
72 zmem = (z_mem *)malloc(allocSize);␊
73 if (!zmem) {␊
74 goto finish;␊
75 }␊
76 zmem->alloc_size = allocSize;␊
77 result = (void *)&(zmem->data);␊
78finish:␊
79 return result;␊
80}␊
81␊
82void␊
83z_free(void * notused __unused, void * ptr)␊
84{␊
85 uint32_t * skipper = (uint32_t *)ptr - 1;␊
86 z_mem * zmem = (z_mem *)skipper;␊
87 free((void *)zmem);␊
88 return;␊
89}␊
90␊
91␊
92unsigned long Mkext_Alder32( unsigned char * buffer, long length );␊
93␊
94void KextPatcher_hook(void* current, void* arg2, void* arg3, void* arg4);␊
95␊
96/**␊
97 ** KextPatcher_start -> module start␊
98 **␉␉Notified the module system that this module will hook into the ␊
99 **␉␉LoadMatchedModules and LoadDriverMKext functions␊
100 **/␊
101void KextPatcher_start()␊
102{␉␉␊
103␉// Hooks into the following:␊
104␉//␉execute_hook("LoadDriverMKext", (void*)package, (void*) length, NULL, NULL);␊
105␉// execute_hook("LoadMatchedModules", module, &length, executableAddr, NULL);␊
106␊
107␉register_hook_callback("PCIDevice", &KextPatcher_hook);␊
108␉//register_hook_callback("LoadMatchedModules", &kext_loaded); ␊
109␉register_hook_callback("LoadDriverMKext", &mkext_loaded); ␊
110␊
111}␊
112␊
113/**␊
114 ** kext_loaded -> Called whenever a kext is in read into memory␊
115 **␉␉This function will be used to patch kexts ( eg AppleInteIntegratedFramebuffer)␊
116 **␉␉and their plists when they are loaded into memmory␊
117 **/␊
118void kext_loaded(void* moduletmp, void* lengthprt, void* executableAddr, void* arg3)␊
119{␊
120␉␊
121␉//ModulePtr module = moduletmp;␊
122␉//long length = *(long*)lengthprt;␊
123␉//long length2 = strlen(module->plistAddr);␊
124␉// *(long*)lengthprt = length2 + 5 * 1024 * 1024;␊
125␊
126␉//printf("Loading %s, lenght is %d, executable is 0x%X\n", module->plistAddr, length, executableAddr);␊
127␉//getc();␊
128}␊
129␊
130/**␊
131 ** mkext_loaded -> Called whenever an mkext is in read into memory␊
132 **␉␉This function will be used to patch mkext. Matching kexts will be␊
133 **␉␉Extracted, modified, and then compressed again. Note: I need to determine␊
134 **␉␉what sort of slowdown this will cause and if it's worth implimenting.␊
135 **/␊
136␊
137void mkext_loaded(void* filespec, void* packagetmp, void* lengthtmp, void* arg3)␊
138{␊
139␉const char* hda_codec;␊
140␉int len = 0;␊
141␉if (getValueForKey(kHDACodec, &hda_codec, &len, &bootInfo->bootConfig))␊
142␉{␊
143␉␉patch_hda_codec = 0;␊
144␉␉int index = 0;␊
145␉␉while(len--)␊
146␉␉{␊
147␉␉␉patch_hda_codec <<= 4;␊
148␉␉␉patch_hda_codec |= chartohex(hda_codec[index]);␊
149␉␉␉index++;␊
150␉␉}␊
151␉}␊
152␉␉␊
153␉if(!NEEDS_PATCHING) return;␉// No need to apply a patch, hardware doesn't need it␊
154␉␊
155␉int version = 0;␊
156␉//int length = *((int*)lengthtmp);␊
157␉mkext_basic_header* package = packagetmp;␊
158␊
159␉// Verify the MKext.␊
160 if (( MKEXT_GET_MAGIC(package)␉␉!= MKEXT_MAGIC ) ||␊
161 ( MKEXT_GET_SIGNATURE(package)␉!= MKEXT_SIGN ) ||␊
162 ( MKEXT_GET_LENGTH(package)␉␉> kLoadSize )␉ ||␊
163 ( MKEXT_GET_CHECKSUM(package) !=␊
164␉␉ Mkext_Alder32((unsigned char *)&package->version, MKEXT_GET_LENGTH(package) - 0x10) ) )␊
165 {␊
166 return;␊
167␉␉// Don't try to patch a b␊
168 }␉␊
169␉␊
170␉/*␊
171␉if(strcmp(filespec, "/System/Library/Caches/com.apple.kext.caches/Startup/Extensions.mkext") == 0)␊
172␉{␊
173␉␉printf("Invalidating mkext %s\n", filespec);␊
174␉␉// 10.6 cache folder. Doesn't contain certain extensions we need, so invalidate it.␊
175␉␉//package->adler32++;␊
176␉␉// NOTE: double check that this is needed␊
177␉␉package->magic = 0x00;␊
178␉␉return;␊
179␉}*/␊
180␉␊
181␉␊
182␉version = MKEXT_GET_VERSION(package);␊
183␉␊
184␉if(version == 0x01008000) // mkext1␊
185␉{␊
186␉␉// mkext1 uses lzss␊
187␉␉mkext1_header* package = packagetmp;␊
188␉␉int i;␊
189␉␉for(i = 0; i < MKEXT_GET_COUNT(package); i++)␊
190␉␉{␊
191␉␉␉DBG("Parsing kext %d\n", i);␊
192␉␉␉//mkext_kext* kext = MKEXT1_GET_KEXT(package, i);␊
193␉␉␉// uses decompress_lzss␊
194␉␉␉// TODO: handle kext␊
195␊
196␉␉}␊
197␉}␊
198␉else if((version & 0xFFFF0000) == 0x02000000) // mkext2␊
199␉{␊
200␉␉DBG("Mkext2 package located at 0x%X\n", package);␊
201␊
202␉␉// mkext2 uses zlib␉␉␊
203␉␉mkext2_header* package = packagetmp;␊
204␉␉z_stream zstream;␊
205␉␉bool zstream_inited = false;␊
206␉␉int zlib_result;␊
207␉␉int plist_offset = MKEXT2_GET_PLIST(package);␊
208␉␉␊
209␉␉char* plist = malloc(MKEXT2_GET_PLIST_FULLSIZE(package));␊
210␉␉␊
211␉␉bzero(&zstream, sizeof(zstream));␉␉␊
212␉␉zstream.next_in = (UInt8*)((char*)package + plist_offset);␊
213␉␉zstream.avail_in = MKEXT2_GET_PLIST_COMPSIZE(package);␊
214␉␉␊
215␉␉zstream.next_out = (UInt8*)plist;␊
216␉␉zstream.avail_out = MKEXT2_GET_PLIST_FULLSIZE(package);␊
217␉␉␊
218␉␉zstream.zalloc = z_alloc;␊
219␉␉zstream.zfree = z_free;␊
220␉␉␉␉␊
221␉␉zlib_result = inflateInit(&zstream);␊
222␉␉if (Z_OK != zlib_result)␊
223␉␉{␊
224␉␉␉printf("ZLIB Error: %s\n", zstream.msg);␊
225␉␉␉getc();␊
226␉␉}␊
227␉␉else ␊
228␉␉{␊
229␉␉␉zstream_inited = true;␊
230␉␉}␊
231␊
232␉␉␊
233␉␉zlib_result = inflate(&zstream, Z_FINISH);␊
234␉␉if (zstream_inited) inflateEnd(&zstream);␊
235␊
236␉␉DBG("Inflated result is %d, in: %d bytes, out: %d bytes\n", zlib_result, zstream.total_in, zstream.total_out);␊
237␉␉if (zlib_result == Z_STREAM_END || zlib_result == Z_OK)␊
238␉␉{␉␉␉␊
239␉␉␉config_file_t plistData;␊
240␉␉␉config_file_t allDicts;␊
241␉␉␉bzero(&plistData, sizeof(plistData));␊
242␉␉␉bzero(&allDicts, sizeof(allDicts));␊
243␉␉␉␊
244␉␉␉XMLParseFile( plist, &plistData.dictionary );␊
245␊
246␉␉␉int count;␊
247␊
248␉␉␉allDicts.dictionary = XMLGetProperty(plistData.dictionary, kMKEXTInfoDictionariesKey);␊
249␉␉␉//count = XMLTagCount(allDicts.dictionary);␊
250␊
251␉␉␉//DBG("Plist contains %d kexts\n", count);␊
252␉␉␉␊
253␉␉␉␊
254␉␉␉bool patched = false;␊
255␉␉␉for(count = XMLTagCount(allDicts.dictionary);␊
256␉␉␉␉count > 0;␊
257␉␉␉␉count--)␊
258␉␉␉{␊
259␉␉␉␉TagPtr kextEntry = XMLGetElement(allDicts.dictionary, count);␊
260␉␉␉␉patched |= patch_kext(kextEntry, plist, package);␊
261␉␉␉}␊
262␉␉␉␊
263␊
264␉␉␉if(patched)␊
265␉␉␉{␊
266␉␉␉␉zstream_inited = false;␊
267␉␉␉␉// Recompress the plist␊
268␉␉␉␉bzero(&zstream, sizeof(zstream));␉␉␊
269␉␉␉␉zstream.next_in = (UInt8*)plist;␊
270␉␉␉␉zstream.next_out = (UInt8*)package + plist_offset;␊
271␉␉␉␉zstream.avail_in = MKEXT2_GET_PLIST_FULLSIZE(package);␊
272␉␉␉␉zstream.avail_out = MKEXT2_GET_PLIST_FULLSIZE(package)<<2;␉// Give us some extra free space, just in case␊
273␉␉␉␉zstream.zalloc = Z_NULL;␊
274␉␉␉␉zstream.zfree = Z_NULL;␊
275␉␉␉␉zstream.opaque = Z_NULL;␊
276␉␉␉␉␊
277␉␉␉␉␊
278␉␉␉␉zlib_result = deflateInit2(&zstream, Z_DEFAULT_COMPRESSION, Z_DEFLATED,15, 8 /* memLevel */, Z_DEFAULT_STRATEGY);␊
279␉␉␉␉if (Z_OK != zlib_result) {␊
280␉␉␉␉␉printf("ZLIB Deflate Error: %s\n", zstream.msg);␊
281␉␉␉␉␉getc();␊
282␉␉␉␉}␊
283␉␉␉␉else ␊
284␉␉␉␉{␊
285␉␉␉␉␉zstream_inited = true;␊
286␉␉␉␉}␊
287␉␉␉␉␊
288␉␉␉␉zlib_result = deflate(&zstream, Z_FINISH);␊
289␉␉␉␉␊
290␉␉␉␉if (zlib_result == Z_STREAM_END)␊
291␉␉␉␉{␊
292␉␉␉␉␉DBG("Deflated result is %d, in: %d bytes, out: %d bytes, full: %d\n", zlib_result, zstream.total_in, zstream.total_out, MKEXT2_GET_PLIST_FULLSIZE(package));␊
293␉␉␉␉} ␊
294␉␉␉␉else if (zlib_result == Z_OK)␊
295␉␉␉␉{␊
296␉␉␉␉␉/* deflate filled output buffer, meaning the data doesn't compress.␊
297␉␉␉␉␉ */␊
298␉␉␉␉␉DBG("Deflated result is %d, in: %d bytes, out: %d bytes, full: %d\n", zlib_result, zstream.total_in, zstream.total_out, MKEXT2_GET_PLIST_FULLSIZE(package));␊
299␉␉␉␉␉␊
300␉␉␉␉} ␊
301␉␉␉␉else if (zlib_result != Z_STREAM_ERROR)␊
302␉␉␉␉{␊
303␉␉␉␉␉printf("ZLIB Deflate Error: %s\n", zstream.msg);␊
304␉␉␉␉␉getc();␊
305␉␉␉␉}␊
306␉␉␉␉␊
307␉␉␉␉if(zstream.total_out != MKEXT2_GET_PLIST_COMPSIZE(package))␊
308␉␉␉␉{␊
309␉␉␉␉␉// Update the mkext length␊
310␉␉␉␉␉MKEXT2_HDR_CAST(package)->length = MKEXT_SWAP(MKEXT_GET_LENGTH(package) - MKEXT2_GET_PLIST_COMPSIZE(package) + zstream.total_out);␊
311␉␉␉␉␉MKEXT2_HDR_CAST(package)->plist_compressed_size = MKEXT_SWAP(zstream.total_out);␊
312␉␉␉␉␉*((int*)lengthtmp) -= MKEXT2_GET_PLIST_COMPSIZE(package);␊
313␉␉␉␉␉*((int*)lengthtmp) += zstream.total_out;␊
314␉␉␉␉}␊
315␉␉␉␉␉␉␉␉␊
316␉␉␉␉if (zstream_inited) deflateEnd(&zstream);␊
317␉␉␉␉␊
318␉␉␉␉␊
319␉␉␉␉␊
320␉␉␉␉// re alder32 the new mkext2 package␊
321␉␉␉␉MKEXT_HDR_CAST(package)->adler32 = ␊
322␉␉␉␉␉MKEXT_SWAP(Mkext_Alder32((unsigned char *)&package->version,␊
323␉␉␉␉␉␉␉␉␉␉␉ MKEXT_GET_LENGTH(package) - 0x10));␊
324␉␉␉}␊
325␉␉}␊
326␉␉else␊
327␉␉{␊
328␉␉␉printf("ZLIB Error: %s\n", zstream.msg);␊
329␉␉␉getc();␊
330␉␉}␊
331␊
332␉␉//config_file_t mkextPlist;␊
333␉␉//ParseXMLFile((char*) plist, &mkextPlist.dictionary);␊
334␉␉␊
335␉␉␊
336␉␉␊
337␉␉␊
338␉␉␊
339␉␉/*␉␉int i;␊
340␉␉for(i = 0; i < MKEXT_GET_COUNT(package); i++)␊
341␉␉{␊
342␉␉␉printf("Parsing kext %d\n", i);␊
343␉␉}␊
344␉␉*/␊
345␉␉␊
346␊
347␉}␊
348␊
349␉␊
350␉DBG("Loading %s, version 0x%x\n", filespec, version);␊
351␉//getc();␊
352}␊
353␊
354// FIXME: only handles mkext2 entries␊
355bool patch_kext(TagPtr plist, char* plistbuffer, void* start)␊
356{␊
357␉char* bundleID;␊
358␉␊
359␉if(XMLGetProperty(plist, kMKEXTExecutableKey) == NULL) return false;␉// Kext is a plist only kext, don't patch␊
360␉␊
361␉bundleID = XMLCastString(XMLGetProperty(plist, kPropCFBundleIdentifier));␊
362␉␊
363␉␊
364␉if(patch_gma_deviceid &&␊
365␉ (␊
366␉␉␉(strcmp(bundleID, "com.apple.driver.AppleIntelGMA950") == 0) ||␊
367␉␉␉(strcmp(bundleID, "com.apple.driver.AppleIntelIntegratedFramebuffer") == 0)␊
368␉␉ )␊
369␉ )␊
370␉{␊
371␉␉if(strcmp(bundleID, "com.apple.driver.AppleIntelIntegratedFramebuffer") == 0 || patch_gma_deviceid == 0x27ae)␊
372␉␉{␊
373␉␉␉return patch_gma_kexts(plist, plistbuffer, start);␊
374␉␉}␊
375␉␉else␊
376␉␉{␊
377␉␉␉return patch_gma_kexts(plist, plistbuffer, start);␊
378␉␉}␊
379␊
380␉}␊
381␉else if(patch_bcm_deviceid && (strcmp(bundleID, "com.apple.driver.AirPortBrcm43xx") == 0))␊
382␉{␊
383␉␉return patch_bcm_kext(plist, plistbuffer, start);␊
384␊
385␉}␊
386␉else if(patch_hda_codec && strcmp(bundleID, "com.apple.driver.AppleHDA") == 0)␊
387␉{␊
388␉␉return patch_hda_kext(plist, plistbuffer, start);␊
389␊
390␉}␊
391␉␊
392␉else if(patch_hda_codec && strcmp(bundleID, "com.apple.driver.AppleHDAController") == 0)␊
393␉{␊
394␉␉return patch_hda_controller(plist, plistbuffer, start);␊
395␊
396␉}␊
397␉␊
398␉return false;␊
399}␊
400␊
401void KextPatcher_hook(void* arg1, void* arg2, void* arg3, void* arg4)␊
402{␊
403␉pci_dt_t* current = arg1;␊
404␉if(current)␊
405␉{␊
406␉␉switch(current->class_id)␊
407␉␉{␊
408␉␉␉case PCI_CLASS_DISPLAY_VGA:␊
409␉␉␉␉if(current->vendor_id == 0x8086 && ␊
410␉␉␉␉ (␊
411␉␉␉␉␉current->device_id == 0x27AE ||␊
412␉␉␉␉␉current->device_id == 0xA001 ||␊
413␉␉␉␉␉current->device_id == 0xA002 ||␊
414␉␉␉␉␉current->device_id == 0xA011 ||␊
415␉␉␉␉␉current->device_id == 0xA012␊
416␊
417␉␉␉␉␉)␊
418␉␉␉␉ )␊
419␉␉␉␉{␊
420␉␉␉␉␉patch_gma_deviceid = current->device_id;␊
421␉␉␉␉}␊
422␉␉␉␉break;␊
423␉␉␉␉␊
424␉␉␉case PCI_CLASS_NETWORK_OTHER:␊
425␉␉␉␉␊
426␉␉␉␉// Patch BCM43xx␊
427␉␉␉␉if(current->vendor_id == 0x14E4 && ((current->device_id & 0xFFD0) == 0x4300))␊
428␉␉␉␉{␊
429␉␉␉␉␉patch_bcm_deviceid = current->device_id;␊
430␉␉␉␉}␊
431␉␉␉␉break;␊
432␉␉}␊
433␉}␊
434}␊
435␊
436␊
437bool patch_hda_controller(TagPtr plist, char* plistbuffer, void* start)␊
438{␊
439␉return false;␊
440␉// change the PCI class code to match to. Note: A LegacyHDA plist should do this on it's own␊
441␉// As such, it's disabled␊
442␊
443␉// TODO: read class code␊
444␉TagPtr personality;␊
445␉personality =␉␉XMLCastDict(XMLGetProperty(plist, kPropIOKitPersonalities));␊
446␉personality =␉␉XMLGetProperty(personality, (const char*)"BuiltInHDA");␉␊
447␉TagPtr match_class =XMLCastArray(XMLGetProperty(personality, (const char*)"IOPCIClassMatch"));␊
448␉␊
449␉␊
450␉char* new_str = malloc(strlen("0xXXXX000&0xFFFE0000")+1);␊
451␉sprintf(new_str, "0x04030000&amp;0xFFFE0000"); // todo, pass in actual class id␊
452␉␊
453␉␊
454␉char* orig_string = "0x04020000&amp;0xFFFE0000"; //XMLCastString(match_class);␊
455␉␊
456␉printf("Attemting to replace '%s' with '%s'\n", orig_string, new_str);␊
457␉␊
458␉// TODO: verify string doesn't exist first.␊
459␉␊
460␉replace_string(orig_string, new_str, plistbuffer + XMLCastStringOffset(match_class), 1024);␊
461␉␊
462␉return true;␊
463␉␊
464}␊
465␊
466␊
467bool patch_hda_kext(TagPtr plist, char* plistbuffer, void* start)␊
468{␊
469␉uint16_t find_codec = 0;␊
470␉int full_size, compressed_size, executable_offset;␊
471␉void* compressed_data;␊
472␉mkext2_file_entry* kext;␊
473␉int zlib_result;␊
474␉z_stream zstream;␊
475␉bool zstream_inited = false;␊
476␊
477␉switch(patch_hda_codec & 0xFF00)␊
478␉{␊
479␉␉case 0x0200:␊
480␉␉␉find_codec = 0x0262;␊
481␉␉␉break;␊
482␊
483␉␉case 0x0800:␊
484␉␉␉find_codec = 0x0885;␊
485␉␉␉break;␊
486␉␉␉␊
487␉␉case 0x0600:␉// specificaly the 662␊
488␉␉␉find_codec = 0x0885;␊
489␉␉␉break;␊
490␉}␊
491␉if(!find_codec) return false;␉// notify caller that we aren't patching the kext␊
492␉␉␊
493␉executable_offset = XMLCastInteger(XMLGetProperty(plist, kMKEXTExecutableKey));␊
494␉kext = (void*)((char*)start + executable_offset);␊
495␊
496␉full_size = MKEXT2_GET_ENTRY_FULLSIZE(kext);␊
497␉compressed_size = MKEXT2_GET_ENTRY_COMPSIZE(kext);␊
498␉compressed_data = MKEXT2_GET_ENTRY_DATA(kext);␉␊
499␉executable_offset = XMLCastInteger(XMLGetProperty(plist, kMKEXTExecutableKey));␊
500␉␊
501␉␊
502␉char* executable = malloc(full_size);␊
503␉␊
504␉bzero(&zstream, sizeof(zstream));␉␉␊
505␉zstream.next_in = (UInt8*)compressed_data;␊
506␉zstream.avail_in = compressed_size;␊
507␉␊
508␉zstream.next_out = (UInt8*)executable;␊
509␉zstream.avail_out = full_size;␊
510␉␊
511␉zstream.zalloc = z_alloc;␊
512␉zstream.zfree = z_free;␊
513␉␊
514␉zlib_result = inflateInit(&zstream);␊
515␉if (Z_OK != zlib_result)␊
516␉{␊
517␉␉printf("ZLIB Inflate Error: %s\n", zstream.msg);␊
518␉␉getc();␊
519␉}␊
520␉else ␊
521␉{␊
522␉␉zstream_inited = true;␊
523␉}␊
524␉␊
525␉␊
526␉zlib_result = inflate(&zstream, Z_FINISH);␊
527␉␊
528␉DBG("Inflated result is %d, in: %d bytes, out: %d bytes, full: %d\n", zlib_result, zstream.total_in, zstream.total_out, full_size);␊
529␉␉␊
530␉/*int times = */replace_word(0x10EC0000 | (find_codec), 0x10EC0000 | (patch_hda_codec), executable, zstream.total_out);␊
531␉if (zstream_inited) inflateEnd(&zstream);␊
532␉␊
533␉␊
534␉zstream.next_in = (UInt8*)executable;␊
535␉zstream.next_out = (UInt8*)compressed_data;␊
536␉␊
537␉zstream.avail_in = full_size;␊
538␉zstream.avail_out = compressed_size<<1;␊
539␉zstream.zalloc = Z_NULL;␊
540␉zstream.zfree = Z_NULL;␊
541␉zstream.opaque = Z_NULL;␊
542␉␊
543␉␊
544␉␊
545␉// Recompress the eecutable␊
546␉zlib_result = deflateInit2(&zstream, Z_DEFAULT_COMPRESSION, Z_DEFLATED,15, 8 /* memLevel */, Z_DEFAULT_STRATEGY);␊
547␉if (Z_OK != zlib_result) {␊
548␉␉printf("ZLIB Deflate Error: %s\n", zstream.msg);␊
549␉␉getc();␊
550␉}␊
551␉else ␊
552␉{␊
553␉␉zstream_inited = true;␊
554␉}␊
555␉␊
556␉zlib_result = deflate(&zstream, Z_FINISH);␊
557␉␊
558␉if (zlib_result == Z_STREAM_END)␊
559␉{␊
560␉␉DBG("Deflated result is %d, avail: %d bytes, out: %d bytes, full: %d\n", zlib_result, compressed_size, zstream.total_out, full_size);␊
561␉} ␊
562␉else if (zlib_result == Z_OK)␊
563␉{␊
564␉␉/* deflate filled output buffer, meaning the data doesn't compress.␊
565␉␉ */␊
566␉␉DBG("Buffer FULL: deflated result is %d, avail: %d bytes, out: %d bytes, full: %d\n", zlib_result, compressed_size, zstream.total_out, full_size);␊
567␉␉printf("Unable to patch AppleHDA\n");␊
568␉␉␊
569␉} ␊
570␉else if (zlib_result != Z_STREAM_ERROR)␊
571␉{␊
572␉␉printf("AppleHDA: ZLIB Deflate Error: %s\n", zstream.msg);␊
573␉␉getc();␊
574␉}␊
575␉␊
576␉if (zstream_inited) deflateEnd(&zstream);␊
577␉␊
578␉if(zstream.total_out < compressed_size) kext->compressed_size = MKEXT_SWAP(zstream.total_out);␊
579␊
580␉␊
581␉free(executable);␊
582␉␊
583␉return true;␉␊
584␊
585}␊
586␊
587bool patch_bcm_kext(TagPtr plist, char* plistbuffer, void* start)␊
588{␊
589␉TagPtr personality;␊
590␉personality =␉␉XMLCastDict(XMLGetProperty(plist, kPropIOKitPersonalities));␊
591␉personality =␉␉XMLGetProperty(personality, (const char*)"Broadcom 802.11 PCI");␉␊
592␉TagPtr match_names =XMLCastArray(XMLGetProperty(personality, (const char*)"IONameMatch"));␊
593␊
594␉␊
595␉char* new_str = malloc(strlen("pci14e4,xxxx")+1);␊
596␉sprintf(new_str, "pci14e4,%02x", patch_bcm_deviceid);␊
597␊
598␉// Check to see if we *really* need to modify the plist, if not, return false␊
599␉// so that *if* this were going ot be the only modified kext, the repacking code␊
600␉// won't need to be executed.␊
601␉int count = XMLTagCount(match_names);␊
602␉while(count)␊
603␉{␊
604␉␉count--;␊
605␉␉TagPtr replace =␉XMLGetElement(match_names, count);␉// Modify the second entry␊
606␉␉char* orig_string = XMLCastString(replace);␊
607␉␉if(strcmp(orig_string, new_str) == 0) return false;␊
608␉}␊
609␊
610␉␊
611␉TagPtr replace =␉XMLGetElement(match_names, 1);␉// Modify the second entry␊
612␉char* orig_string = XMLCastString(replace);␊
613␉␊
614␉␊
615␉// TODO: verify string doesn't exist first.␊
616␉␊
617␉replace_string(orig_string, new_str, plistbuffer + XMLCastStringOffset(replace), 10240);␊
618␊
619␉return true;␊
620}␊
621␊
622bool patch_gma_kexts(TagPtr plist, char* plistbuffer, void* start)␊
623{␊
624␉// TODO: clean up this function / split into two / etc␊
625␉int exeutable_offset, full_size, compressed_size;␊
626␉TagPtr personality;␊
627␉long offset;␊
628␉int zlib_result;␊
629␉z_stream zstream;␊
630␉bool zstream_inited = false;␊
631␉mkext2_file_entry* kext;␊
632␉void* compressed_data;␊
633␊
634␉exeutable_offset = XMLCastInteger(XMLGetProperty(plist, kMKEXTExecutableKey));␊
635␉kext = (void*)((char*)start + exeutable_offset);␊
636␊
637␉full_size = MKEXT2_GET_ENTRY_FULLSIZE(kext);␊
638␉compressed_size = MKEXT2_GET_ENTRY_COMPSIZE(kext);␊
639␉compressed_data = MKEXT2_GET_ENTRY_DATA(kext);␊
640␉␊
641␉personality =␉␉XMLCastDict(XMLGetProperty(plist, kPropIOKitPersonalities));␊
642␉␊
643␉␊
644␉␊
645␉char* executable = malloc(full_size);␊
646␉␊
647␉bzero(&zstream, sizeof(zstream));␉␉␊
648␉zstream.next_in = (UInt8*)compressed_data;␊
649␉zstream.avail_in = compressed_size;␊
650␉␊
651␉zstream.next_out = (UInt8*)executable;␊
652␉zstream.avail_out = full_size;␊
653␉␊
654␉zstream.zalloc = z_alloc;␊
655␉zstream.zfree = z_free;␊
656␉␊
657␉zlib_result = inflateInit(&zstream);␊
658␉if (Z_OK != zlib_result)␊
659␉{␊
660␉␉printf("ZLIB Inflate Error: %s\n", zstream.msg);␊
661␉␉getc();␊
662␉}␊
663␉else ␊
664␉{␊
665␉␉zstream_inited = true;␊
666␉}␊
667␉␊
668␉␊
669␉zlib_result = inflate(&zstream, Z_FINISH);␊
670␉␊
671␉DBG("Inflated result is %d, in: %d bytes, out: %d bytes, full: %d\n", zlib_result, zstream.total_in, zstream.total_out, full_size);␊
672␉␊
673␉char* newstring = malloc(strlen("0x00008086") + 1);␊
674␉sprintf(newstring, "0x%04x", 0x8086 | (patch_gma_deviceid << 16));␊
675␊
676␉␊
677␉if(XMLGetProperty(personality, (const char*)"Intel915"))␊
678␉{␊
679␉␉verbose("Patching AppleIntelGMA950.kext\n");␊
680␉␉//getc();␊
681␊
682␉␉personality =␉␉XMLGetProperty(personality, (const char*)"Intel915");␊
683␉␉// IOAccelerator kext␊
684␉␉␊
685␉␉offset =␉␉XMLCastStringOffset(XMLGetProperty(personality, (const char*)"IOPCIPrimaryMatch"));␉␉␊
686␉␉replace_string("0x27A28086", newstring, plistbuffer + offset, 10240);␊
687␉␉replace_word(0x27A28086, 0x8086 | (patch_gma_deviceid << 16), executable, zstream.total_out);␊
688␊
689␉}␊
690␉else if(XMLGetProperty(personality, (const char*)"AppleIntelIntegratedFramebuffer"))␊
691␉{␊
692␉␉verbose("Patching AppleIntelIntegratedFramebuffer\n");␊
693␉␉//getc();␊
694␊
695␉␉personality =␉␉XMLGetProperty(personality, (const char*)"AppleIntelIntegratedFramebuffer");␊
696␉␉// Framebuffer Kext␊
697␉␉␊
698␉␉if((patch_gma_deviceid & 0xFF00) == 0xA000)␉// GMA3150␊
699␉␉{␊
700␉␉␉// Cursor corruption fix.␊
701␉␉␉// This patch changes the cursor address from␊
702␉␉␉// a physical address (used in the gma950) to an offset (used in the gma3150).␊
703␉␉␉//s␉␉␉␉␉{0x8b, 0x55, 0x08, 0x83, 0xba, 0xb0, 0x00, 0x00, 0x00, 0x01, 0x7e, 0x36, 0x89, 0x04, 0x24, 0xe8, 0x6b, 0xbc, 0xff, 0xff};␊
704␉␉␉char find_bytes[] = {0x8b, 0x55, 0x08, 0x83, 0xba, 0xb0, 0x00, 0x00, 0x00, 0x01, 0x7e, 0x36, 0x89, 0x04, 0x24, 0xe8/*, 0x32, 0xbb, 0xff, 0xff*/};␉// getPhysicalAddress() and more␊
705␉␉␉char new_bytes[] = {0xb8, 0x00, 0x00, 0x00, 0x02, 0xEB, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};␉// jump past getPhysicalAddress binding. NOTE: last six bytes are unusable␊
706␉␉␉replace_bytes(find_bytes, sizeof(find_bytes), new_bytes, sizeof(new_bytes), executable, zstream.total_out);␊
707␉␉␉␊
708␊
709␉␉}␊
710␉␉offset =␉␉XMLCastStringOffset(XMLGetProperty(personality, (const char*)"IOPCIPrimaryMatch"));␉␉␊
711␉␉replace_string("0x27A28086", newstring, plistbuffer + offset, 10240);␊
712␉␉replace_word(0x27A28086, 0x8086 | (patch_gma_deviceid << 16), executable, zstream.total_out);␊
713␉␉␊
714␉}␊
715␉else if(XMLGetProperty(personality, (const char*)"Intel965"))␊
716␉{␊
717␉␉verbose("Patching AppleIntelGMAX3100.kext\n");␊
718␊
719␉␉personality =␉␉XMLGetProperty(personality, (const char*)"Intel965");␊
720␉␉␊
721␉␉offset =␉␉XMLCastStringOffset(XMLGetProperty(personality, (const char*)"IOPCIPrimaryMatch"));␉␉␊
722␉␉␊
723␉␉//printf("Intel965\n");␊
724␉␉//printf("Replacing %c%c%c%c\n", (plistbuffer + offset)[0], (plistbuffer + offset)[1], (plistbuffer + offset)[2], (plistbuffer + offset)[3]);␊
725␉␉//getc();␊
726␊
727␉␉␊
728␉␉//return true;␊
729␊
730␉␉replace_string("0x2a028086", newstring, plistbuffer + offset, 10240);␊
731␉␉//replace_word(0x2A028086, 0x8086 | (patch_gma_deviceid << 16), executable, zstream.total_out);␊
732␉}␊
733␉else if(XMLGetProperty(personality, (const char*)"AppleIntelGMAX3100FB"))␊
734␉{␊
735␉␉verbose("Patching AppleIntelGMAX3100FB.kext\n");␊
736␉␉//getc();␊
737␉␉personality =␉␉XMLGetProperty(personality, (const char*)"AppleIntelGMAX3100FB");␊
738␉␉␊
739␉␉offset =␉␉XMLCastStringOffset(XMLGetProperty(personality, (const char*)"IOPCIPrimaryMatch"));␉␉␊
740␉␉replace_string("0x2A028086", newstring, plistbuffer + offset, 10240);␊
741␉␉replace_word(0x2A028086, 0x8086 | (patch_gma_deviceid << 16), executable, zstream.total_out);␊
742␉}␊
743␉else␊
744␉{␊
745␉␉return false;␊
746␉}␊
747␊
748␉␊
749␉if (zstream_inited) inflateEnd(&zstream);␊
750␉␊
751␉␊
752␉zstream.next_in = (UInt8*)executable;␊
753␉zstream.next_out = (UInt8*)compressed_data;␊
754␉␊
755␉zstream.avail_in = full_size;␊
756␉zstream.avail_out = compressed_size;␊
757␉zstream.zalloc = Z_NULL;␊
758␉zstream.zfree = Z_NULL;␊
759␉zstream.opaque = Z_NULL;␊
760␉␊
761␉␊
762␉␊
763␉// Recompress the eecutable␊
764␉zlib_result = deflateInit2(&zstream, Z_DEFAULT_COMPRESSION, Z_DEFLATED,15, 8 /* memLevel */, Z_DEFAULT_STRATEGY);␊
765␉if (Z_OK != zlib_result) {␊
766␉␉printf("ZLIB Deflate Error: %s\n", zstream.msg);␊
767␉␉getc();␊
768␉}␊
769␉else ␊
770␉{␊
771␉␉zstream_inited = true;␊
772␉}␊
773␉␊
774␉zlib_result = deflate(&zstream, Z_FINISH);␊
775␉␊
776␉if (zlib_result == Z_STREAM_END)␊
777␉{␊
778␉␉DBG("Deflated result is %d, avail: %d bytes, out: %d bytes, full: %d\n", zlib_result, compressed_size, zstream.total_out, full_size);␊
779␉} ␊
780␉else if (zlib_result == Z_OK)␊
781␉{␊
782␉␉/* deflate filled output buffer, meaning the data doesn't compress.␊
783␉␉ */␊
784␉␉printf("Deflated result is %d, in: %d bytes, out: %d bytes, full: %d\n", zlib_result, zstream.total_in, zstream.total_out, full_size);␊
785␉␉printf("ERROR: Unable to compress patched kext, not enough room.\n");␊
786␉␉pause();␊
787␉␉␊
788␉} ␊
789␉else if (zlib_result != Z_STREAM_ERROR)␊
790␉{␊
791␉␉printf("ZLIB Deflate Error: %s\n", zstream.msg);␊
792␉␉getc();␊
793␉}␊
794␉if(zstream.total_out < compressed_size) kext->compressed_size = MKEXT_SWAP(zstream.total_out);␊
795␊
796␉␊
797␉␊
798␉␊
799␉if (zstream_inited) deflateEnd(&zstream);␊
800␉␊
801␉free(executable);␊
802␉␊
803␉return true;␉␊
804}␊
805␊
806int chartohex(char c)␊
807{␊
808␉if(c <= '9' && c >= '0')␊
809␉{␊
810␉␉return c - '0';␉// c is between 0 and 9␊
811␉}␊
812␉else if(c <= 'F' && c >= 'A')␊
813␉{␊
814␉␉return c - 'A' + 10; // c = 10 - 15;␊
815␉}␊
816␉else if(c <= 'f' && c >= 'a')␊
817␉{␊
818␉␉return c - 'a' + 10; // c = 10 - 15;␊
819␉}␊
820␉return 0;␊
821}

Archive Download this file

Revision: 717