ProjectOSX

Welcome Guest!

Returning User? Login here.

Want membership privileges? Register here.

 
Start a new topic Add Reply
> Re-route Kext Method, re-route kext method
iostres
post Jul 30 2011, 08:45 AM
Post #1
Hi!

This is my first binary kext patching so please bear with my lack of knowledge.

I have a kext I would like to modify - more precisely I would like to replace 2 methods defined inside it with my own. I was thinking creating my functions in assembly and just paste them inside kext to original functions positions. That would work if my function sizes was smaller or equal to origina which is not the case so I think I need to find a way to call my own methods located in new kext/modified kernel - re-routing calls to original methods with my own.

What is the way to go here? I am not asking for complete solution - just some pointers which direction to investigate. If there is an example available that would be great. Is it possible to use asm "call" to some other function defined somewhere else?



BR,
iostres
iostres
post Jul 30 2011, 12:52 PM
Post #2
I found that I can simply get address of the function (function pointer) from one kext and just call it from other kext like this:

asm ("movq $0xffffff7f808dee58, %%rax\n"
"call *%%rax\n"
:
:
: "%rax");

where 0xffffff7f808dee58 is address of a function.

This is ok but it makes me know correct address of a function so I would rather do calling by symbol name. Any ideas?

BR,
iostres
Slice
post Jul 30 2011, 09:27 PM
Post #3
I have another idea. Remember that all kexts for MacOSX written in C++ using subclasses of Apple's common classes.
So you can subclass your interesting kext to call native methods that you do not want to change and call your method instead of native if you want.
Not sure I know exact example for that but FakeSMC substitute some methods instead of IOACPIPlatformDevice.
Пожалуйста, прочитайте ЧаВо!
i3-2120 GA-H61M-S1, Radeon HD6670, ALC887(VoodooHDA 2.8.4), OS⌘10.9.1, OS⌘ 10.7.5 Clover FakeSMC_plugins_3.3.1 Realtek LAN v3.1.2
iostres
post Jul 30 2011, 09:47 PM
Post #4
QUOTE (Slice @ Jul 30 2011, 10:27 PM) *
I have another idea. Remember that all kexts for MacOSX written in C++ using subclasses of Apple's common classes.
So you can subclass your interesting kext to call native methods that you do not want to change and call your method instead of native if you want.
Not sure I know exact example for that but FakeSMC substitute some methods instead of IOACPIPlatformDevice.


Hi Slice,

thanks for the answer :-). I was thinking about that but (not sure on this one) I think I can substitute only methods from original kext designated as virtual in original C++ class...or am I wrong? I will try to do some subclassing on my two test kexts to see how that works - it's been a long time since I last mangled vtables tongue.gif.

I.
Slice
post Jul 31 2011, 07:08 AM
Post #5
Yep, only virtual.
You also can rewrite a corresponding IOxxxFamily. May be it helps.

Or very rough hack.
Create separate kext with a needed procedure with some signature.
Place into original kext search for the signature in whole memory.
Call the proc placed near the signature. mellow.gif

Or vice versa. Your kext should search for original in the whole memory and place here a long jump.
Your kext should have dependency on original to be loaded after it.
Пожалуйста, прочитайте ЧаВо!
i3-2120 GA-H61M-S1, Radeon HD6670, ALC887(VoodooHDA 2.8.4), OS⌘10.9.1, OS⌘ 10.7.5 Clover FakeSMC_plugins_3.3.1 Realtek LAN v3.1.2
iostres
post Jul 31 2011, 10:05 AM
Post #6
QUOTE (Slice @ Jul 31 2011, 07:08 AM) *
Or very rough hack.
Create separate kext with a needed procedure with some signature.
Place into original kext search for the signature in whole memory.
Call the proc placed near the signature. mellow.gif

Or vice versa. Your kext should search for original in the whole memory and place here a long jump.
Your kext should have dependency on original to be loaded after it.


Hi Slice,

this is the method I will go for - search should be possible to do in a few asm commands so it would fit in every method I want to replace. Any quick idea how to implement search for a symbol in a good way? It doesn't have to be spectacularly fast since it will be done only at computer startup.

I.
iostres
post Jul 31 2011, 10:30 AM
Post #7
QUOTE (iostres @ Jul 31 2011, 10:05 AM) *
Hi Slice,

this is the method I will go for - search should be possible to do in a few asm commands so it would fit in every method I want to replace. Any quick idea how to implement search for a symbol in a good way? It doesn't have to be spectacularly fast since it will be done only at computer startup.

I.


Reply to my own post...weird :-).

I decided to do something like this:


void my_func(void) {

asm( "nop;"
"nop;"
"nop;"
"nop;"
"nop;"
"nop;");

/* rest of the function */
}

So I will search code segment for 6 nops - after finding it, two instructions up is function address - then just call the function to patch original kext. That's the plan - let's see if that will be possible.

Also I will take a look at "nm" utility and how it reads symbol table - that might be even better way to do it.

Comments are welcome :-).

I.

This post has been edited by iostres: Jul 31 2011, 10:31 AM
iostres
post Jul 31 2011, 04:49 PM
Post #8
This is shortest search function I could do:

CODE
    .text
.globl _search2
_search2:
    pushq    %rbp
    movq    %rsp, %rbp
    movq    %rdi, %rax
1:
    cmpl     $0x90909090, (%rax)
    je     2f
    leaq    8(%rax),%rax
    jmp     1b
2:    
    leave
    ret


Any possibility to firther optimize it? (I have 16 nops in a row as a marker.

I.

This post has been edited by iostres: Jul 31 2011, 04:52 PM
Slice
post Aug 1 2011, 11:01 AM
Post #9
It is not a unique sequence. I found it in Lion's mach_kernel.
Write something like
CODE
a = "my favorite dog";

disassemble the code and search it.
Пожалуйста, прочитайте ЧаВо!
i3-2120 GA-H61M-S1, Radeon HD6670, ALC887(VoodooHDA 2.8.4), OS⌘10.9.1, OS⌘ 10.7.5 Clover FakeSMC_plugins_3.3.1 Realtek LAN v3.1.2
iostres
post Aug 2 2011, 12:00 PM
Post #10
QUOTE (Slice @ Aug 1 2011, 12:01 PM) *
It is not a unique sequence. I found it in Lion's mach_kernel.
Write something like
CODE
a = "my favorite dog";

disassemble the code and search it.


Hm...that won't be stored in function itself but in data section. Something like this seems a bit better I think:

CODE
jmp jump_over
0xba
0xba
0xfa
0xfa
0xde
0xda
jump_over:


This will endup inside subroutine so it won't be hard to locate start of subroutine. I checked in SL and Lion kernel - no such sequence.

Add Reply Start a new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members: