testing/kernel-cache-tests/kernel-vtable-patching-large-base-addr/test.py

   1 #!/usr/bin/python2.7
   2
   3 import os
   4 import KernelCollection
   5
   6 # This tests verifies that the vtable in bar.kext is patched
   7 # But also that this can be done against a subclass in the kernel, not just
   8
   9 # Note this is the same as kernel-vtable-patching but with a large base address
  10
  11 def check(kernel_cache):
  12     kernel_cache.buildKernelCollection("x86_64", "/kernel-vtable-patching-large-base-addr/main.kc", "/kernel-vtable-patching-large-base-addr/main.kernel", "/kernel-vtable-patching-large-base-addr/extensions", ["com.apple.bar"], [])
  13     kernel_cache.analyze("/kernel-vtable-patching-large-base-addr/main.kc", ["-layout", "-arch", "x86_64"])
  14
  15     assert len(kernel_cache.dictionary()["dylibs"]) == 2
  16     assert kernel_cache.dictionary()["dylibs"][0]["name"] == "com.apple.kernel"
  17     assert kernel_cache.dictionary()["dylibs"][1]["name"] == "com.apple.bar"
  18
  19     # Get the addresses for the symbols we are looking at.  This will make it easier to work out the fixup slots
  20     kernel_cache.analyze("/kernel-vtable-patching-large-base-addr/main.kc", ["-symbols", "-arch", "x86_64"])
  21
  22     # From foo, we want to know where the vtable is, and the foo() and fooUsed0() slots in that vtable
  23     # Foo::foo()
  24     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][27]["name"] == "__ZN3Foo3fooEv"
  25     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][27]["vmAddr"] == "0xFFFFFF8000205EC0"
  26     # Foo::fooUsed0()
  27     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][28]["name"] == "__ZN3Foo8fooUsed0Ev"
  28     assert kernel_cache.dictionary()["dylibs"][0]["global-symbols"][28]["vmAddr"] == "0xFFFFFF8000205EE0"
  29
  30     # From bar, find the vtable and its override of foo()
  31     # Bar::foo()
  32     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][3]["name"] == "__ZN3Bar3fooEv"
  33     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][3]["vmAddr"] == "0xFFFFFF8000206F10"
  34
  35
  36     # Check the fixups
  37     kernel_cache.analyze("/kernel-vtable-patching-large-base-addr/main.kc", ["-fixups", "-arch", "x86_64"])
  38
  39     # In vtable for Foo, we match the entry for Foo::foo() by looking for its value on the RHS of the fixup
  40     assert kernel_cache.dictionary()["fixups"]["0x108500"] == "kc(0) + 0xFFFFFF8000205EC0 : pointer64"
  41     # Then the following fixup should be to Foo::fooUsed0()
  42     assert kernel_cache.dictionary()["fixups"]["0x108508"] == "kc(0) + 0xFFFFFF8000205EE0 : pointer64"
  43
  44     # Now in bar, again match the entry for its Bar::foo() symbol
  45     assert kernel_cache.dictionary()["fixups"]["0x111150"] == "kc(0) + 0xFFFFFF8000206F10"
  46     # And if the patching was correct, then following entry should be to Foo::fooUsed0()
  47     assert kernel_cache.dictionary()["fixups"]["0x111158"] == "kc(0) + 0xFFFFFF8000205EE0"
  48
  49
  50 # [~]> xcrun -sdk macosx.internal cc -arch x86_64 -Wl,-static -mkernel -nostdlib -Wl,-e,__start -Wl,-pie main.cpp foo.cpp -Wl,-pagezero_size,0x0 -o main.kernel -Wl,-image_base,0xffffff8000200000 -Wl,-segaddr,__HIB,0xffffff8000100000 -Wl,-add_split_seg_info -Wl,-install_name,/usr/lib/swift/split.seg.v2.hack -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers -Wl,-sectcreate,__LINKINFO,__symbolsets,SymbolSets.plist -Wl,-segprot,__LINKINFO,r--,r--  -DFOO_USED=1
  51 # [~]> xcrun -sdk macosx.internal cc -arch x86_64 -Wl,-kext -mkernel -nostdlib -Wl,-add_split_seg_info -Wl,-no_data_const bar.cpp -o extensions/bar.kext/bar -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers
  52 # [~]> rm -r extensions/*.kext/*.ld
  53