Skip to content

iOS 15.6+ support #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
neuschaefer wants to merge 14 commits into
base: master
Choose a base branch
from
Open

iOS 15.6+ support #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
3f263a9
Fix a few typos
neuschaefer Oct 29, 2025
063f9f1
klog: Fix potential out-of-bounds write
neuschaefer Oct 29, 2025
90e1cb2
loader: Specify C files before LD flags
neuschaefer Oct 29, 2025
77da65a
module/pf: Add offline patchfinder (for quicker testing)
neuschaefer Oct 30, 2025
64104e1
pf/15: Port lck_rw_alloc_init to iOS 15.4+
neuschaefer Oct 30, 2025
6f33e43
pf/15: Port kalloc_external finder to 15.4+
neuschaefer Oct 30, 2025
c9fb4c2
pf/15: Port kernel_map finder to 15.1+
neuschaefer Oct 30, 2025
c3955b6
pf/15: Port current_proc finder to 15.4+
neuschaefer Oct 30, 2025
c42293a
pf/15: Port vm_allocate_external finder to 15.4+
neuschaefer Oct 30, 2025
b99b7b6
pf/15: Port proc_ref,proc_rele finder to 15.4+
neuschaefer Oct 30, 2025
aa30792
pf/15: Port vm_map_t->refcnt finder to 15.5+
neuschaefer Oct 30, 2025
335c053
pf/15: Port ipc_port_release_send finder to 15.4+
neuschaefer Oct 30, 2025
4b29462
pf/15: Use more reliable pattern for ipc_port_release_send
neuschaefer Nov 6, 2025
4ea9f89
pf/15: Port vm_dealloc finder to 15.5+
neuschaefer Oct 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions include/pf/15/pf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,6 @@ bool proc_list_mlock_lck_mtx_lock_unlock_finder_15(xnu_pf_patch_t *, void *);
bool lck_grp_free_finder_15(xnu_pf_patch_t *, void *);
bool proc_ref_rele_finder_15(xnu_pf_patch_t *, void *);
bool lck_rw_alloc_init_finder_15(xnu_pf_patch_t *, void *);
bool vm_allocate_external_finder_15(xnu_pf_patch_t *, void *);

#endif
4 changes: 4 additions & 0 deletions include/pf/pf_common.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ struct pf {

#define LISTIZE(...) __VA_ARGS__

#ifndef PF_DECL32
#define PF_DECL32(name, matches, masks, mmcount, callback, seg) \
{ \
.pf_name = name, \
Expand All @@ -39,7 +40,9 @@ struct pf {
.pf_section = NULL, \
.pf_unused = 0, \
}
#endif

#ifndef PF_DECL_FULL
#define PF_DECL_FULL(name, matches, masks, mmcount, access, callback, kext, seg, sect) \
{ \
.pf_name = name, \
Expand All @@ -53,6 +56,7 @@ struct pf {
.pf_section = sect, \
.pf_unused = 0, \
}
#endif

#define PF_UNUSED { .pf_unused = 1 }

Expand Down
151 changes: 96 additions & 55 deletions include/pf/pfs.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,16 +93,18 @@ struct pf g_all_pfs[MAXPF][NUM_SUPPORTED_VERSIONS] = {
"__TEXT_EXEC", NULL),
PF_DECL_FULL("kalloc_external finder iOS 15",
LISTIZE({
0x910022f7, /* add x23, x23, #0x8 */
0x910022e0, /* add xNN, x23, #0x8 */
0x910043a8, /* add x8, x29, #0x10 */
0xf9000fe8, /* str w8, [sp, #0x18] */
0x52808008, /* mov w8, #0x400 */
}),
LISTIZE({
0xffffffe0, /* ignore Rd */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* ignore offset */
0xffffffff, /* match exactly */
}),
3, XNU_PF_ACCESS_32BIT, kalloc_external_finder_14,
4, XNU_PF_ACCESS_32BIT, kalloc_external_finder_14,
"com.apple.driver.AppleMobileFileIntegrity",
"__TEXT_EXEC", NULL),
},
Expand Down Expand Up @@ -589,16 +591,18 @@ struct pf g_all_pfs[MAXPF][NUM_SUPPORTED_VERSIONS] = {
7, lck_rw_alloc_init_finder_14, "__TEXT_EXEC"),
PF_DECL_FULL("lck_rw_alloc_init finder iOS 15",
LISTIZE({
0xd2800016, /* mov x22, #0 */
0xf9400260, /* ldr x0, [x19] */
0xd2800001, /* mov x1, #0 */
0xf9400000, /* ldr x0, [xn, n] */
0xd2800001, /* mov x1, #0 */
0x94000000, /* bl _lck_rw_alloc_init */
0xf9000e60, /* str x0, [x19, #0x18] */
}),
LISTIZE({
0xffc0001f, /* ignore all but Rt */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xfc000000, /* ignore branch target */
0xffffffff, /* match exactly */
}),
3, XNU_PF_ACCESS_32BIT, lck_rw_alloc_init_finder_15,
4, XNU_PF_ACCESS_32BIT, lck_rw_alloc_init_finder_15,
"com.apple.filesystems.lifs", "__TEXT_EXEC", NULL),
},
{
Expand Down Expand Up @@ -1061,44 +1065,46 @@ struct pf g_all_pfs[MAXPF][NUM_SUPPORTED_VERSIONS] = {
PF_UNUSED,
PF_DECL32("kernel_map finder iOS 15",
LISTIZE({
0x94000000, /* bl n */
0xf9400340, /* ldr x0, [x26] */
0x94000000, /* bl _vm_map_page_mask */
0xaa0003f4, /* mov x20, x0 */
0x0, /* ignore this instruction */
0x9ba87c00, /* umull Xn, w0, w8 */
0xf9400340, /* ldr x0, [x26] */
0x94000000, /* bl _vm_map_page_mask */
0xaa0003f9, /* mov x25, x0 */
0xf9400340, /* ldr x0, [x26] */
0x94000000, /* bl _vm_map_page_mask */
}),
LISTIZE({
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0x0, /* ignore this instruction */
0xffffffe0, /* ignore Rd */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
}),
4, kernel_map_finder_15, "__TEXT_EXEC"),
8, kernel_map_finder_15, "__TEXT_EXEC"),
},
{
PF_UNUSED,
PF_UNUSED,
PF_DECL32("vm_deallocate finder iOS 15",
LISTIZE({
0x94000000, /* bl n */
0xf900001f, /* str xzr, [Xn, n] */
0x3900001f, /* strb wzr, [Xn, n] */
0xb4000000, /* cbz Xn, n */
0x0, /* ignore this instruction */
0x0, /* ignore this instruction */
0xaa0003e1, /* mov x1, Xn */
0xaa0003e2, /* mov x2, Xn */
0x94000000, /* bl _vm_deallocate */
0xf900007f, /* str xzr, [x19, n] */
0xb8000008, /* ldr w8, [x19, n] */
0x12147908, /* and w8, w8, #0xfffff7ff */
0xb8000008, /* str w8, [x19, n] */
}),
LISTIZE({
0xfc000000, /* ignore immediate */
0xffc0001f, /* ignore Rn & immediate */
0xffc0001f, /* ignore Rn & immediate */
0xff000000, /* ignore Rn & immediate */
0x0, /* ignore this instruction */
0x0, /* ignore this instruction */
0xffe0ffff, /* ignore Rn */
0xffe0ffff, /* ignore Rn */
0xffff00ff, /* ignore immediate */
0xfc00001f, /* ignore immediate */
0xffffffff, /* match exactly */
0xfc00001f, /* ignore immediate */
}),
8, vm_deallocate_finder_15, "__TEXT_EXEC"),
5, vm_deallocate_finder_15, "__TEXT_EXEC"),
},
{
PF_DECL_FULL("kernel_thread_start,thread_deallocate finder iOS 13",
Expand Down Expand Up @@ -1302,18 +1308,27 @@ struct pf g_all_pfs[MAXPF][NUM_SUPPORTED_VERSIONS] = {
PF_UNUSED,
PF_DECL32("current_proc finder iOS 15",
LISTIZE({
0x39402a88, /* ldrb w8, [x20, #0xa] */
0x35000008, /* cbnz w8, n */
0x94000000, /* bl current_proc */
0xf9000e80, /* str x0, [x20, #0x18] */
0xaa0003e0, /* mov x0, xN */
0xd2800001, /* mov x1, #0 */
0xd2800002, /* mov x2, #0 */
0x52800043, /* mov w3, #2 */
0x94000000, /* bl n */
0xf9400000, /* ldr x0, [Xn, n] */
0x94000000, /* bl n */
0x94000000, /* bl n */

}),
LISTIZE({
0xffe0ffff, /* ignore Rm */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffc0001f, /* ignore signed offset */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffc0001f, /* ignore Rn & immediate */
0xfc000000, /* ignore immediate */
0xfc000000, /* ignore immediate */
}),
4, current_proc_finder_15, "__TEXT_EXEC"),
8, current_proc_finder_15, "__TEXT_EXEC"),
},
{
PF_DECL_FULL("proc stuff finder 1 iOS 13",
Expand Down Expand Up @@ -1606,24 +1621,26 @@ struct pf g_all_pfs[MAXPF][NUM_SUPPORTED_VERSIONS] = {
5, ipc_port_release_send_finder_13, "__TEXT_EXEC"),
PF_DECL32("ipc_object_lock/ipc_port_release_send_and_unlock finder iOS 15",
LISTIZE({
0x910006e8, /* add x8, x23, #1 */
0xf100091f, /* cmp x8, 2 */
0x540000a3, /* b.lo 0x1c */
0xaa1703e0, /* mov x0, x23 */
0x94000000, /* bl _ipc_object_lock */
0xaa1703e0, /* mov x0, x23 */
0x94000000 /* bl _ipc_port_release_send_and_unlock */
0xaa0003f3, /* mov x19, x0 */
0x94000000, /* bl ipc_object_lock */
0xaa1303e0, /* mov x0, x19 */
0x94000000, /* bl ipc_port_release_send_and_unlock */
0xa9417bfd, /* ldp x29, x30, [sp, #0x10] */
0xa8c24ff4, /* ldp x20, x19, [sp], #0x20 */
0x52800000, /* mov w0, #0 */
0xd65f03c0, /* ret */
}),
LISTIZE({
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
}),
7, ipc_port_release_send_finder_15, "__TEXT_EXEC"),
8, ipc_port_release_send_finder_15, "__TEXT_EXEC"),
},
{
PF_DECL32("lck_rw_free finder iOS 13",
Expand Down Expand Up @@ -2246,16 +2263,30 @@ struct pf g_all_pfs[MAXPF][NUM_SUPPORTED_VERSIONS] = {
0xfc000000, /* ignore immediate */
}),
2, vm_allocate_external_finder_13, "__TEXT_EXEC"),
PF_DECL32("vm_allocate_external finder iOS 15",
PF_DECL_FULL("vm_allocate_external finder iOS 15",
LISTIZE({
0x53187C64, /* lsr w4, w3, #0x18 */
0x14000000, /* b n */
0x2a2003e8, /* mvn w8, w0 */
0x93407d08, /* sxtw x8, w8 */
0x8a170117, /* and x23, x8, x23 */
0xf9400340, /* ldr x0, [x26] */
0xd10163a1, /* sub x1, x29, #0x58 */
0xaa1703e2, /* mov x2, x23 */
0x52800023, /* mov w3, #1 */
0x94000000, /* bl vm_allocate */
}),
LISTIZE({
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
}),
2, vm_allocate_external_finder_13, "__TEXT_EXEC"),
8, XNU_PF_ACCESS_32BIT, vm_allocate_external_finder_15,
"com.apple.iokit.IONetworkingFamily",
"__TEXT_EXEC", NULL),
},
{
PF_DECL32("vm_map_deallocate, offsetof(vm_map_t, refcnt) finder iOS 13",
Expand Down Expand Up @@ -2353,16 +2384,26 @@ struct pf g_all_pfs[MAXPF][NUM_SUPPORTED_VERSIONS] = {
PF_UNUSED,
PF_DECL32("proc_ref,proc_rele finder iOS 15",
LISTIZE({
0xaa1903f8, /* mov x24, x25 */
0xaa1803e0, /* mov x0, x24 */
0x52800021, /* mov w1, #1 */
0xaa1403e0, /* mov x0, x20 */
0x94000000, /* bl _proc_rele */
0xf9400eb5, /* ldr x21, [x21, #0x18] */
0xb4000000, /* cbz x21, n */
0xf94012a8, /* ldr x8, [x21, #0x20] */
0x9356fd08, /* asr x8, x8, #22 */
0xf9400d14, /* ldr x20, [x8, #0x18] */
0xaa1403e0, /* mov x0, x20 */
}),
LISTIZE({
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0xfc000000, /* ignore immediate */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
0xffffffff, /* match exactly */
}),
3, proc_ref_rele_finder_15, "__TEXT_EXEC"),
8, proc_ref_rele_finder_15, "__TEXT_EXEC"),
},
{
PF_DECL_FULL("lck_mtx_lock finder iOS 13",
Expand Down
2 changes: 1 addition & 1 deletion include/xnuspy/xnuspy_ctl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ enum {
COPYINSTR,
COPYOUT,

/* Idential to XNU's implementation */
/* Identical to XNU's implementation */
CURRENT_MAP,

CURRENT_PROC,
Expand Down
2 changes: 1 addition & 1 deletion klog/klog.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ int main(int argc, char **argv){

char buf[1024];
memset(buf, 0, sizeof(buf));
ssize_t r = read(klog_fd, buf, sizeof(buf));
ssize_t r = read(klog_fd, buf, sizeof(buf) - 1);

if(r < 0){
printf("read failed: %s\n", strerror(errno));
Expand Down
2 changes: 1 addition & 1 deletion loader/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,4 @@ TARGET = loader
SOURCES = loader.c

$(TARGET) : $(SOURCES)
$(CC) $(CFLAGS) $(LDFLAGS) $(SOURCES) -o $(TARGET)
$(CC) $(CFLAGS) $(SOURCES) $(LDFLAGS) -o $(TARGET)
11 changes: 7 additions & 4 deletions module/pf/13/pf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1302,7 +1302,7 @@ bool vm_allocate_external_finder_13(xnu_pf_patch_t *patch,
return true;
}

/* Confirmed working on all kernels 13.0 - 15.0 */
/* Confirmed working on all kernels 13.0 - 15.8 */
bool vm_map_deallocate_offsetof_vm_map_refcnt_finder_13(xnu_pf_patch_t *patch,
void *cacheable_stream){
/* vm_map_reference does not exist on release kernels because it was
Expand All @@ -1318,11 +1318,14 @@ bool vm_map_deallocate_offsetof_vm_map_refcnt_finder_13(xnu_pf_patch_t *patch,

g_vm_map_deallocate_addr = xnu_ptr_to_va(vm_map_deallocate);

/* Now get the offset of the reference count. Searching
* for add xn, x19, #n */
/* Now get the offset of the reference count. Searching for
* add x0, xn, #n
* ldxr w8, [x0]
*/
uint32_t instr_limit = 100;

while((*vm_map_deallocate & 0xffc003e0) != 0x91000260){
while((vm_map_deallocate[0] & 0xffc0001f) != 0x91000000 &&
(vm_map_deallocate[1] & 0xffffffff) != 0x885f7c08){
if(instr_limit-- == 0)
return false;

Expand Down
2 changes: 1 addition & 1 deletion module/pf/14/pf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
uint64_t g_kalloc_external_addr = 0;
uint64_t g_kfree_ext_addr = 0;

/* Confirmed working 14.0 - 15.0 */
/* Confirmed working 14.0 - 15.8 */
bool kalloc_external_finder_14(xnu_pf_patch_t *patch, void *cacheable_stream){
/* We've landed somewhere inside AMFI, kalloc_external is the
* branch six instructions down */
Expand Down
Loading