testing/kernel-cache-tests/kext-vtable-patching-arm64e/test.py

   1 #!/usr/bin/python2.7
   2
   3 import os
   4 import KernelCollection
   5
   6 # This verifies that a kext can bind to another kext
   7 # foo.kext exports foo and bar.kext uses it
   8 # bar.kext then exports foo and baz.kext binds to it
   9
  10 # Note this is the same as the kext-vtable-patching test, just with arm64e so ptrauth on the fixups
  11
  12 def check(kernel_cache):
  13     kernel_cache.buildKernelCollection("arm64e", "/kext-vtable-patching-arm64e/main.kc", "/kext-vtable-patching-arm64e/main.kernel", "/kext-vtable-patching-arm64e/extensions", ["com.apple.foo", "com.apple.bar", "com.apple.baz"], [])
  14     kernel_cache.analyze("/kext-vtable-patching-arm64e/main.kc", ["-layout", "-arch", "arm64e"])
  15
  16     assert len(kernel_cache.dictionary()["dylibs"]) == 4
  17     assert kernel_cache.dictionary()["dylibs"][0]["name"] == "com.apple.kernel"
  18     assert kernel_cache.dictionary()["dylibs"][1]["name"] == "com.apple.bar"
  19     assert kernel_cache.dictionary()["dylibs"][2]["name"] == "com.apple.baz"
  20     assert kernel_cache.dictionary()["dylibs"][3]["name"] == "com.apple.foo"
  21
  22     # Get the addresses for the symbols we are looking at.  This will make it easier to work out the fixup slots
  23     kernel_cache.analyze("/kext-vtable-patching-arm64e/main.kc", ["-symbols", "-arch", "arm64e"])
  24
  25     # From bar, find the vtable and its override of foo()
  26     # Bar::foo()
  27     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][3]["name"] == "__ZN3Bar3fooEv"
  28     assert kernel_cache.dictionary()["dylibs"][1]["global-symbols"][3]["vmAddr"] == "0x2036C"
  29
  30     # From baz, find the vtable and its override of foo()
  31     # Baz::foo()
  32     assert kernel_cache.dictionary()["dylibs"][2]["global-symbols"][3]["name"] == "__ZN3Baz3fooEv"
  33     assert kernel_cache.dictionary()["dylibs"][2]["global-symbols"][3]["vmAddr"] == "0x2085C"
  34
  35     # From foo, we want to know where the vtable is, and the foo() and fooUsed0() slots in that vtable
  36     # Foo::foo()
  37     assert kernel_cache.dictionary()["dylibs"][3]["global-symbols"][6]["name"] == "__ZN3Foo3fooEv"
  38     assert kernel_cache.dictionary()["dylibs"][3]["global-symbols"][6]["vmAddr"] == "0x20DE8"
  39     # Foo::fooUsed0()
  40     assert kernel_cache.dictionary()["dylibs"][3]["global-symbols"][7]["name"] == "__ZN3Foo8fooUsed0Ev"
  41     assert kernel_cache.dictionary()["dylibs"][3]["global-symbols"][7]["vmAddr"] == "0x20E00"
  42
  43
  44     # Check the fixups
  45     kernel_cache.analyze("/kext-vtable-patching-arm64e/main.kc", ["-fixups", "-arch", "arm64e"])
  46
  47     # In vtable for Foo, we match the entry for Foo::foo() by looking for its value on the RHS of the fixup
  48     assert kernel_cache.dictionary()["fixups"]["0x20480"] == "kc(0) + 0x20DE8 auth(IA addr 49764)"
  49     # Then the following fixup should be to Foo::fooUsed0()
  50     assert kernel_cache.dictionary()["fixups"]["0x20488"] == "kc(0) + 0x20E00 auth(IA addr 61962)"
  51
  52     # Now in bar, again match the entry for its Bar::foo() symbol
  53     assert kernel_cache.dictionary()["fixups"]["0x200E8"] == "kc(0) + 0x2036C auth(IA addr 49764)"
  54     # And if the patching was correct, then following entry should be to Foo::fooUsed0()
  55     assert kernel_cache.dictionary()["fixups"]["0x200F0"] == "kc(0) + 0x20E00 auth(IA addr 61962)"
  56
  57     # Now in baz, again match the entry for its Baz::foo() symbol
  58     assert kernel_cache.dictionary()["fixups"]["0x202B0"] == "kc(0) + 0x2085C auth(IA addr 49764)"
  59     # And if the patching was correct, then following entry should be to Foo::fooUsed0()
  60     assert kernel_cache.dictionary()["fixups"]["0x202B8"] == "kc(0) + 0x20E00 auth(IA addr 61962)"
  61
  62
  63 # [~]> xcrun -sdk iphoneos.internal cc -arch arm64e -Wl,-static -mkernel -nostdlib -Wl,-e,__start -Wl,-pie main.cpp -Wl,-pagezero_size,0x0 -o main.kernel -Wl,-image_base,0x10000 -Wl,-add_split_seg_info -Wl,-install_name,/usr/lib/swift/split.seg.v2.hack -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers -Wl,-sectcreate,__LINKINFO,__symbolsets,SymbolSets.plist -Wl,-segprot,__LINKINFO,r--,r-- -Wl,-fixup_chains -Wl,-kernel
  64 # [~]> xcrun -sdk iphoneos.internal cc -arch arm64e -Wl,-kext -mkernel -nostdlib -Wl,-add_split_seg_info -Wl,-no_data_const foo.cpp -o extensions/foo.kext/foo -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers -DFOO_USED=1
  65 # [~]> xcrun -sdk iphoneos.internal cc -arch arm64e -Wl,-kext -mkernel -nostdlib -Wl,-add_split_seg_info -Wl,-no_data_const bar.cpp -o extensions/bar.kext/bar -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers
  66 # [~]> xcrun -sdk iphoneos.internal cc -arch arm64e -Wl,-kext -mkernel -nostdlib -Wl,-add_split_seg_info -Wl,-no_data_const baz.cpp -o extensions/baz.kext/baz -iwithsysroot /System/Library/Frameworks/Kernel.framework/Headers
  67 # [~]> rm -r extensions/*.kext/*.ld
  68