iOS 15.6+ support - #22
Open
neuschaefer wants to merge 14 commits into
Open
Conversation
If read returns the full buffer size, then buf[r] = '\0' will write one byte past the buffer. Prevent this by reading at most sizeof(buf)-1 bytes.
Some linkers require that symbols are used first, and then defined. This resulted in libusb symbols not being found while building on Alpine Linux.
The old pattern broke with 15.4, the new callside (in OSSymbol::initialize) is stable across all iOS 15.x versions.
In 15.4, the first instruction changed to "add x25, x23, jsherman212#8", so ignore the destination register there. For good measure, match on the allocation size (0x400), though.
The old finder broke with 15.1, but the new one is stable across all 15.x versions.
The previous code pattern disappeared in 15.4, this pattern is stable across all 15.x versions.
The previous pattern broke with iOS 15.4, but the new pattern works on all versions 15.x.
The code in vm_map_deallocate changed slightly in iOS 15.5, but the updated finder should work with all versions of 15.x.
In 15.4, the register allocation changed slightly, so detect both variants.
Sometime after iOS 15.0, two additional arguments were added to the
function called at the detected location, both set to zero, which means
that this call site doesn't call vm_dealloc anymore but a different,
related function.
The easiest way out is to find another vm_dealloc call site. The
callsite that I picked works on iOS 15.0 and 15.5+. In versions 15.1 -
15.4, direct calls to vm_deallocate apparently didn't exist.
Originally, I included three more instructions in the pattern, before
the bl, but these turned out not to exist in the iphone8,1 kernel, for
example. The instructions:
0x5280002a, /* mov w10, jsherman212#1 */
0x1ac92149, /* lsl w9, w10, w9 */
0x8b29c102, /* add x2, x8, w9, sxtw */
This was referenced Nov 9, 2025
neuschaefer
marked this pull request as draft
November 10, 2025 02:05
neuschaefer
marked this pull request as ready for review
November 10, 2025 21:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds support for newer iOS 15.x versions. I have tested it on an iPhone8,1 with iOS 15.8.5 (kernel version 21.6). More information is in the individual commits, which I've deliberately left separate in order to increase readability.
Known issues:
Although hookingthis was due to an incorrect local patch that is not part of this PR. It actually works now!hookmeworks as expected, hooking real kernel code causes a panic