testing/kernel-cache-tests/auxkc-vtable-metaclass-patching/test.py

   1 #!/usr/bin/python2.7
   2
   3 import os
   4 import KernelCollection
   5
   6 # OSMetaClass in the kernel has a vtable which has to be patched in to Foo::MetaClass
   7
   8 def check(kernel_cache):
   9     kernel_cache.buildKernelCollection("x86_64", "/auxkc-vtable-metaclass-patching/main.kc", "/auxkc-vtable-metaclass-patching/main.kernel", None, [], [])
  10     kernel_cache.analyze("/auxkc-vtable-metaclass-patching/main.kc", ["-layout", "-arch", "x86_64"])
  11
  12     assert len(kernel_cache.dictionary()["dylibs"]) == 1
  13     assert kernel_cache.dictionary()["dylibs"][0]["name"] == "com.apple.kernel"
  14
  15     # Get the addresses for the symbols we are looking at.  This will make it easier to work out the fixup slots
  16     kernel_cache.analyze("/auxkc-vtable-metaclass-patching/main.kc", ["-symbols", "-arch", "x86_64"])
  17
  18     # From OSMetaClass, we want to know where the vtable is, and the foo() and fooUsed0() slots in that vtable
  19     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][11]["name"] == "__ZN15OSMetaClassBase11placeholderEv"
  20     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][11]["vmAddr"] == "0x14BE0"
  21     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][12]["name"] == "__ZN15OSMetaClassBase18metaclassBaseUsed4Ev"
  22     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][12]["vmAddr"] == "0x14BF0"
  23     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][13]["name"] == "__ZN15OSMetaClassBase18metaclassBaseUsed5Ev"
  24     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][13]["vmAddr"] == "0x14C10"
  25     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][14]["name"] == "__ZN15OSMetaClassBase18metaclassBaseUsed6Ev"
  26     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][14]["vmAddr"] == "0x14C30"
  27     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][15]["name"] == "__ZN15OSMetaClassBase18metaclassBaseUsed7Ev"
  28     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][15]["vmAddr"] == "0x14C50"
  29
  30
  31     # Check the fixups
  32     kernel_cache.analyze("/auxkc-vtable-metaclass-patching/main.kc", ["-fixups", "-arch", "x86_64"])
  33
  34     # In vtable for OSMetaClass, we match the entry for OSMetaClass::placeholder() by looking for its value on the RHS of the fixup
  35     assert kernel_cache.dictionary()["fixups"]["0x14168"] == "kc(0) + 0x14BE0 : pointer64"
  36     # Then the following fixup should be to OSMetaClass::metaclassBaseUsed4()
  37     assert kernel_cache.dictionary()["fixups"]["0x14170"] == "kc(0) + 0x14BF0 : pointer64"
  38     # Then OSMetaClass::metaclassBaseUsed5()
  39     assert kernel_cache.dictionary()["fixups"]["0x14178"] == "kc(0) + 0x14C10 : pointer64"
  40     # Then OSMetaClass::metaclassBaseUsed6()
  41     assert kernel_cache.dictionary()["fixups"]["0x14180"] == "kc(0) + 0x14C30 : pointer64"
  42     # Then OSMetaClass::metaclassBaseUsed7()
  43     assert kernel_cache.dictionary()["fixups"]["0x14188"] == "kc(0) + 0x14C50 : pointer64"
  44
  45
  46     # -----------------------------------------------------------
  47     # Now build an aux cache using the baseline kernel collection
  48     kernel_cache.buildAuxKernelCollection("x86_64", "/auxkc-vtable-metaclass-patching/aux.kc", "/auxkc-vtable-metaclass-patching/main.kc", "", "/auxkc-vtable-metaclass-patching/extensions", ["com.apple.foo"], [])
  49     kernel_cache.analyze("/auxkc-vtable-metaclass-patching/aux.kc", ["-layout", "-arch", "x86_64"])
  50
  51     assert len(kernel_cache.dictionary()["dylibs"]) == 1
  52     assert kernel_cache.dictionary()["dylibs"][0]["name"] == "com.apple.foo"
  53
  54     # Get the addresses for the symbols we are looking at.  This will make it easier to work out the fixup slots
  55     kernel_cache.analyze("/auxkc-vtable-metaclass-patching/aux.kc", ["-symbols", "-arch", "x86_64"])
  56
  57     # From foo.kext, find the vtable and its override of placeholder()
  58     # Foo::placeholder()
  59     assert kernel_cache.dictionary()["dylibs"][0]["local-symbols"][4]["name"] == "__ZN3Foo11placeholderEv"
  60     assert kernel_cache.dictionary()["dylibs"][0]["local-symbols"][4]["vmAddr"] == "0xCF90"
  61
  62
  63     # Check the fixups
  64     kernel_cache.analyze("/auxkc-vtable-metaclass-patching/aux.kc", ["-fixups", "-arch", "x86_64"])
  65
  66     # Now in foo.kext, match the entry for its Foo::placeholder() symbol
  67     assert kernel_cache.dictionary()["dylibs"][0]["fixups"]["0x50"] == "kc(3) + 0xCF90"
  68     # And if the patching was correct, then following entry should be to OSMetaClass::metaclassBaseUsed4()
  69     assert kernel_cache.dictionary()["dylibs"][0]["fixups"]["0x58"] == "kc(0) + 0x10BF0"
  70     # Then OSMetaClass::metaclassBaseUsed5()
  71     assert kernel_cache.dictionary()["dylibs"][0]["fixups"]["0x60"] == "kc(0) + 0x10C10"
  72     # Then OSMetaClass::metaclassBaseUsed6()
  73     assert kernel_cache.dictionary()["dylibs"][0]["fixups"]["0x68"] == "kc(0) + 0x10C30"
  74     # Then OSMetaClass::metaclassBaseUsed7()
  75     assert kernel_cache.dictionary()["dylibs"][0]["fixups"]["0x70"] == "kc(0) + 0x10C50"
  76
  77
  78 # [~]> xcrun -sdk macosx.internal cc -arch x86_64 -Wl,-static -mkernel -nostdlib -Wl,-e,__start -Wl,-pie main.cpp -Wl,-pagezero_size,0x0 -o main.kernel -Wl,-image_base,0x10000 -Wl,-segaddr,__HIB,0x4000 -Wl,-add_split_seg_info -Wl,-install_name,/usr/lib/swift/split.seg.v2.hack -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers -Wl,-sectcreate,__LINKINFO,__symbolsets,SymbolSets.plist -Wl,-segprot,__LINKINFO,r--,r-- -DMETACLASS_BASE_USED=1
  79 # [~]> xcrun -sdk macosx.internal cc -arch x86_64 -Wl,-kext -mkernel -nostdlib -Wl,-add_split_seg_info -Wl,-no_data_const foo.cpp -o extensions/foo.kext/foo -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers
  80 # [~]> rm -r extensions/*.kext/*.ld
  81