Mach/Inject.cpp

   1 /* Cycript - Optimizing JavaScript Compiler/Runtime
   2  * Copyright (C) 2009-2013  Jay Freeman (saurik)
   3 */
   4
   5 /* GNU General Public License, Version 3 {{{ */
   6 /*
   7  * Cycript is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published
   9  * by the Free Software Foundation, either version 3 of the License,
  10  * or (at your option) any later version.
  11  *
  12  * Cycript is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with Cycript.  If not, see <http://www.gnu.org/licenses/>.
  19 **/
  20 /* }}} */
  21
  22 #include <dlfcn.h>
  23
  24 #include <mach/mach.h>
  25 #include <mach/mach_vm.h>
  26
  27 #include <mach/machine/thread_status.h>
  28
  29 #include <cstdio>
  30 #include <pthread.h>
  31 #include <unistd.h>
  32
  33 #include "Baton.hpp"
  34 #include "Exception.hpp"
  35 #include "Pooling.hpp"
  36 #include "Trampoline.t.hpp"
  37
  38 void InjectLibrary(pid_t pid) {
  39     const char *library(CY_LIBRARY);
  40
  41     mach_port_t self(mach_task_self()), task;
  42     _krncall(task_for_pid(self, pid, &task));
  43
  44     mach_msg_type_number_t count;
  45
  46     task_dyld_info info;
  47     count = TASK_DYLD_INFO_COUNT;
  48     _krncall(task_info(task, TASK_DYLD_INFO, reinterpret_cast<task_info_t>(&info), &count));
  49     _assert(count == TASK_DYLD_INFO_COUNT);
  50     _assert(info.all_image_info_addr != 0);
  51
  52     thread_act_t thread;
  53     _krncall(thread_create(task, &thread));
  54
  55     thread_state_flavor_t flavor;
  56 #if defined (__i386__) || defined(__x86_64__)
  57     x86_thread_state_t state;
  58     flavor = x86_THREAD_STATE;
  59     count = x86_THREAD_STATE_COUNT;
  60 #elif defined(__arm__)
  61     arm_thread_state_t state;
  62     flavor = ARM_THREAD_STATE;
  63     count = ARM_THREAD_STATE_COUNT;
  64 #else
  65     #error XXX: implement
  66 #endif
  67
  68     memset(&state, 0, sizeof(state));
  69     mach_msg_type_number_t read(count);
  70     _krncall(thread_get_state(thread, flavor, reinterpret_cast<thread_state_t>(&state), &read));
  71     _assert(read == count);
  72
  73     Trampoline *trampoline;
  74     size_t align;
  75     size_t push;
  76
  77 #if defined(__i386__) || defined(__x86_64__)
  78     switch (state.tsh.flavor) {
  79         case i386_THREAD_STATE:
  80             trampoline = &Trampoline_i386_;
  81             align = 4;
  82             push = 5;
  83             break;
  84         case x86_THREAD_STATE64:
  85             trampoline = &Trampoline_x86_64_;
  86             align = 8;
  87             push = 2;
  88             break;
  89         default:
  90             _assert(false);
  91     }
  92 #elif defined(__arm__)
  93     trampoline = &Trampoline_armv6_;
  94     align = 4;
  95     push = 0;
  96 #else
  97     #error XXX: implement
  98 #endif
  99
 100     static const size_t Stack_(8 * 1024);
 101     size_t length(strlen(library) + 1), depth(sizeof(Baton) + length);
 102     depth = (depth + align + 1) / align * align;
 103
 104     CYPool pool;
 105     uint8_t *local(pool.malloc<uint8_t>(depth));
 106     Baton *baton(reinterpret_cast<Baton *>(local));
 107
 108     baton->dyld = info.all_image_info_addr;
 109     baton->pid = getpid();
 110     memcpy(baton->library, library, length);
 111
 112     mach_vm_size_t size(depth + Stack_);
 113     mach_vm_address_t stack;
 114     _krncall(mach_vm_allocate(task, &stack, size, true));
 115
 116     mach_vm_address_t data(stack + Stack_);
 117     _krncall(mach_vm_write(task, data, reinterpret_cast<mach_vm_address_t>(baton), depth));
 118
 119     mach_vm_address_t code;
 120     _krncall(mach_vm_allocate(task, &code, trampoline->size_, true));
 121     _krncall(mach_vm_write(task, code, reinterpret_cast<mach_vm_address_t>(trampoline->data_), trampoline->size_));
 122     _krncall(mach_vm_protect(task, code, trampoline->size_, false, VM_PROT_READ | VM_PROT_EXECUTE));
 123
 124     uint32_t frame[push];
 125     if (sizeof(frame) != 0)
 126         memset(frame, 0, sizeof(frame));
 127
 128 #if defined(__i386__) || defined(__x86_64__)
 129     switch (state.tsh.flavor) {
 130         case i386_THREAD_STATE:
 131             frame[1] = data;
 132             state.uts.ts32.__eip = code + trampoline->entry_;
 133             state.uts.ts32.__esp = stack + Stack_ - sizeof(frame);
 134             break;
 135         case x86_THREAD_STATE64:
 136             state.uts.ts64.__rdi = data;
 137             state.uts.ts64.__rip = code + trampoline->entry_;
 138             state.uts.ts64.__rsp = stack + Stack_ - sizeof(frame);
 139             break;
 140         default:
 141             _assert(false);
 142     }
 143 #elif defined(__arm__)
 144     state.__r[0] = data;
 145     state.__pc = code + trampoline->entry_;
 146     state.__sp = stack + Stack_ - sizeof(frame);
 147
 148     if ((state.__pc & 0x1) != 0) {
 149         state.__pc &= ~0x1;
 150         state.__cpsr |= 0x20;
 151     }
 152 #else
 153     #error XXX: implement
 154 #endif
 155
 156     if (sizeof(frame) != 0)
 157         _krncall(mach_vm_write(task, stack + Stack_ - sizeof(frame), reinterpret_cast<mach_vm_address_t>(frame), sizeof(frame)));
 158
 159     _krncall(thread_set_state(thread, flavor, reinterpret_cast<thread_state_t>(&state), count));
 160     _krncall(thread_resume(thread));
 161
 162     _krncall(mach_port_deallocate(self, task));
 163 }