testing/kernel-cache-tests/auxkc-vtable-patching-no-data-const/test.py

   1 #!/usr/bin/python2.7
   2
   3 import os
   4 import KernelCollection
   5
   6 # Note, this is the same as auxkc-vtable-patching but without __DATA_CONST.  This tests that we get the correct offsets
   7 # even when the vtables are in __DATA which will be mapped lower than the auxKC mach_header
   8
   9 # This verifies that a kext can bind to another kext
  10 # foo.kext exports foo and bar.kext uses it
  11 # We put foo.kext in the base KC so that the patch slot in bar.kext has to know to use the correct fixup level in the fixup chain
  12
  13 def check(kernel_cache):
  14     kernel_cache.buildKernelCollection("x86_64", "/auxkc-vtable-patching-no-data-const/main.kc", "/auxkc-vtable-patching-no-data-const/main.kernel", "/auxkc-vtable-patching-no-data-const/extensions", ["com.apple.foo"], [])
  15     kernel_cache.analyze("/auxkc-vtable-patching-no-data-const/main.kc", ["-layout", "-arch", "x86_64"])
  16
  17     assert len(kernel_cache.dictionary()["dylibs"]) == 2
  18     assert kernel_cache.dictionary()["dylibs"][0]["name"] == "com.apple.kernel"
  19     assert kernel_cache.dictionary()["dylibs"][1]["name"] == "com.apple.foo"
  20
  21     # Get the addresses for the symbols we are looking at.  This will make it easier to work out the fixup slots
  22     kernel_cache.analyze("/auxkc-vtable-patching-no-data-const/main.kc", ["-symbols", "-arch", "x86_64"])
  23
  24     # From foo, we want to know where the vtable is, and the foo() and fooUsed0() slots in that vtable
  25     # Foo::foo()
  26     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][6]["name"] == "__ZN3Foo3fooEv"
  27     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][6]["vmAddr"] == "0x16ED0"
  28     # Foo::fooUsed0()
  29     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][7]["name"] == "__ZN3Foo8fooUsed0Ev"
  30     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][7]["vmAddr"] == "0x16EF0"
  31
  32
  33     # Check the fixups
  34     kernel_cache.analyze("/auxkc-vtable-patching-no-data-const/main.kc", ["-fixups", "-arch", "x86_64"])
  35
  36     # In vtable for Foo, we match the entry for Foo::foo() by looking for its value on the RHS of the fixup
  37     assert kernel_cache.dictionary()["fixups"]["0x1D150"] == "kc(0) + 0x16ED0"
  38     # Then the following fixup should be to Foo::fooUsed0()
  39     assert kernel_cache.dictionary()["fixups"]["0x1D158"] == "kc(0) + 0x16EF0"
  40
  41
  42     # -----------------------------------------------------------
  43     # Now build an aux cache using the baseline kernel collection
  44     kernel_cache.buildAuxKernelCollection("x86_64", "/auxkc-vtable-patching-no-data-const/aux.kc", "/auxkc-vtable-patching-no-data-const/main.kc", "", "/auxkc-vtable-patching-no-data-const/extensions", ["com.apple.bar"], [])
  45     kernel_cache.analyze("/auxkc-vtable-patching-no-data-const/aux.kc", ["-layout", "-arch", "x86_64"])
  46
  47     assert len(kernel_cache.dictionary()["dylibs"]) == 1
  48     assert kernel_cache.dictionary()["dylibs"][0]["name"] == "com.apple.bar"
  49
  50
  51     # Get the addresses for the symbols we are looking at.  This will make it easier to work out the fixup slots
  52     kernel_cache.analyze("/auxkc-vtable-patching-no-data-const/aux.kc", ["-symbols", "-arch", "x86_64"])
  53
  54     # From bar, find the vtable and its override of foo()
  55     # Bar::foo()
  56     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][3]["name"] == "__ZN3Bar3fooEv"
  57     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][3]["vmAddr"] == "0xCF10"
  58
  59
  60     # Check the fixups
  61     kernel_cache.analyze("/auxkc-vtable-patching-no-data-const/aux.kc", ["-fixups", "-arch", "x86_64"])
  62
  63     # Now in bar, again match the entry for its Bar::foo() symbol
  64     assert kernel_cache.dictionary()["dylibs"][0]["fixups"]["0x150"] == "kc(3) + 0xCF10"
  65     # And if the patching was correct, then following entry should be to Foo::fooUsed0()
  66     assert kernel_cache.dictionary()["dylibs"][0]["fixups"]["0x158"] == "kc(0) + 0x12EF0"
  67
  68
  69 # [~]> xcrun -sdk macosx.internal cc -arch x86_64 -Wl,-static -mkernel -nostdlib -Wl,-e,__start -Wl,-pie main.cpp -Wl,-pagezero_size,0x0 -o main.kernel -Wl,-image_base,0x10000 -Wl,-segaddr,__HIB,0x4000 -Wl,-add_split_seg_info -Wl,-install_name,/usr/lib/swift/split.seg.v2.hack -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers -Wl,-sectcreate,__LINKINFO,__symbolsets,SymbolSets.plist -Wl,-segprot,__LINKINFO,r--,r--
  70 # [~]> xcrun -sdk macosx.internal cc -arch x86_64 -Wl,-kext -mkernel -nostdlib -Wl,-add_split_seg_info -Wl,-no_data_const foo.cpp -o extensions/foo.kext/foo -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers -DFOO_USED=1
  71 # [~]> xcrun -sdk macosx.internal cc -arch x86_64 -Wl,-kext -mkernel -nostdlib -Wl,-add_split_seg_info -Wl,-no_data_const bar.cpp -o extensions/bar.kext/bar -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers -Wl,-no_data_const
  72 # [~]> rm -r extensions/*.kext/*.ld
  73