X-Git-Url: https://git.saurik.com/cycript.git/blobdiff_plain/7c6c5b0ab3404f7de369679744f76f78913876c3..38ae783db781810a19b3103bb55c81ea70e7d952:/Mach/Inject.cpp diff --git a/Mach/Inject.cpp b/Mach/Inject.cpp index 198f2f3..a6dcf9f 100644 --- a/Mach/Inject.cpp +++ b/Mach/Inject.cpp @@ -1,9 +1,28 @@ +/* Cycript - Optimizing JavaScript Compiler/Runtime + * Copyright (C) 2009-2013 Jay Freeman (saurik) +*/ + +/* GNU General Public License, Version 3 {{{ */ +/* + * Cycript is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published + * by the Free Software Foundation, either version 3 of the License, + * or (at your option) any later version. + * + * Cycript is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Cycript. If not, see . +**/ +/* }}} */ + #include #include -extern "C" { -#include -} +#include #include #include @@ -14,123 +33,122 @@ extern "C" { #include "Pooling.hpp" #include "Trampoline.t.hpp" -extern "C" void __pthread_set_self(pthread_t); - -template -static void nlset(Type_ &function, struct nlist *nl, size_t index) { - struct nlist &name(nl[index]); - uintptr_t value(name.n_value); - _assert(value != 0); - if ((name.n_desc & N_ARM_THUMB_DEF) != 0) - value |= 0x00000001; - function = value; -} - void InjectLibrary(pid_t pid) { - // XXX: break this into the build environment - const char *library("/usr/lib/libcycript.dylib"); + const char *library(CY_LIBRARY); static const size_t Stack_(8 * 1024); size_t length(strlen(library) + 1), depth(sizeof(Baton) + length); depth = (depth + sizeof(uintptr_t) + 1) / sizeof(uintptr_t) * sizeof(uintptr_t); CYPool pool; - uint8_t *local(reinterpret_cast(apr_palloc(pool, depth))); + uint8_t *local(pool.malloc(depth)); Baton *baton(reinterpret_cast(local)); - uintptr_t set_self_internal; - uintptr_t set_self_external; - - struct nlist nl[3]; - memset(nl, 0, sizeof(nl)); - nl[0].n_un.n_name = (char *) "__pthread_set_self"; - nl[1].n_un.n_name = (char *) "___pthread_set_self"; - nlist("/usr/lib/libSystem.B.dylib", nl); - nlset(set_self_internal, nl, 0); - nlset(set_self_external, nl, 1); - - baton->_pthread_set_self = reinterpret_cast(reinterpret_cast(&__pthread_set_self) - set_self_external + set_self_internal); - - baton->pthread_create = &pthread_create; - baton->pthread_join = &pthread_join; - - baton->dlopen = &dlopen; - baton->dlsym = &dlsym; - - baton->mach_thread_self = &mach_thread_self; - baton->thread_terminate = &thread_terminate; - baton->pid = getpid(); memcpy(baton->library, library, length); - vm_size_t size(depth + Stack_); - mach_port_t self(mach_task_self()), task; _krncall(task_for_pid(self, pid, &task)); + mach_msg_type_number_t count; + + task_dyld_info info; + count = TASK_DYLD_INFO_COUNT; + _krncall(task_info(task, TASK_DYLD_INFO, reinterpret_cast(&info), &count)); + _assert(count == TASK_DYLD_INFO_COUNT); + _assert(info.all_image_info_addr != 0); + baton->dyld = info.all_image_info_addr; + + vm_size_t size(depth + Stack_); vm_address_t stack; _krncall(vm_allocate(task, &stack, size, true)); - vm_address_t data(stack + Stack_); - - vm_write(task, data, reinterpret_cast(baton), depth); - vm_address_t code; - _krncall(vm_allocate(task, &code, sizeof(Trampoline_), true)); - vm_write(task, code, reinterpret_cast(Trampoline_), sizeof(Trampoline_)); - _krncall(vm_protect(task, code, sizeof(Trampoline_), false, VM_PROT_READ | VM_PROT_EXECUTE)); + vm_address_t data(stack + Stack_); + _krncall(vm_write(task, data, reinterpret_cast(baton), depth)); thread_act_t thread; _krncall(thread_create(task, &thread)); thread_state_flavor_t flavor; - mach_msg_type_number_t count; - size_t push; - -#if defined(__arm__) +#if defined (__i386__) || defined(__x86_64__) + x86_thread_state_t state; + flavor = x86_THREAD_STATE; + count = x86_THREAD_STATE_COUNT; +#elif defined(__arm__) arm_thread_state_t state; flavor = ARM_THREAD_STATE; count = ARM_THREAD_STATE_COUNT; - push = 0; -#elif defined(__i386__) - i386_thread_state_t state; - flavor = i386_THREAD_STATE; - count = i386_THREAD_STATE_COUNT; - push = 5; #else #error XXX: implement #endif - uintptr_t frame[push]; - if (sizeof(frame) != 0) - memset(frame, 0, sizeof(frame)); - memset(&state, 0, sizeof(state)); - mach_msg_type_number_t read(count); _krncall(thread_get_state(thread, flavor, reinterpret_cast(&state), &read)); - _assert(count == count); + _assert(read == count); -#if defined(__arm__) - state.r[0] = data; - state.sp = stack + Stack_; - state.pc = code; + Trampoline *trampoline; + size_t push; - if ((state.pc & 0x1) != 0) { - state.pc &= ~0x1; - state.cpsr |= 0x20; +#if defined(__i386__) || defined(__x86_64__) + switch (state.tsh.flavor) { + case i386_THREAD_STATE: + trampoline = &Trampoline_i386_; + push = 5; + break; + case x86_THREAD_STATE64: + trampoline = &Trampoline_x86_64_; + push = 2; + break; + default: + _assert(false); } -#elif defined(__i386__) - frame[0] = 0; - frame[1] = data; +#elif defined(__arm__) + trampoline = &Trampoline_armv6_; + push = 0; +#else + #error XXX: implement +#endif + + vm_address_t code; + _krncall(vm_allocate(task, &code, trampoline->size_, true)); + _krncall(vm_write(task, code, reinterpret_cast(trampoline->data_), trampoline->size_)); + _krncall(vm_protect(task, code, trampoline->size_, false, VM_PROT_READ | VM_PROT_EXECUTE)); - state.__eip = code; - state.__esp = stack + Stack_ - sizeof(frame); + uint32_t frame[push]; + if (sizeof(frame) != 0) + memset(frame, 0, sizeof(frame)); + +#if defined(__i386__) || defined(__x86_64__) + switch (state.tsh.flavor) { + case i386_THREAD_STATE: + frame[1] = data; + state.uts.ts32.__eip = code + trampoline->entry_; + state.uts.ts32.__esp = stack + Stack_ - sizeof(frame); + break; + case x86_THREAD_STATE64: + state.uts.ts64.__rdi = data; + state.uts.ts64.__rip = code + trampoline->entry_; + state.uts.ts64.__rsp = stack + Stack_ - sizeof(frame); + break; + default: + _assert(false); + } +#elif defined(__arm__) + state.__r[0] = data; + state.__pc = code + trampoline->entry_; + state.__sp = stack + Stack_ - sizeof(frame); + + if ((state.__pc & 0x1) != 0) { + state.__pc &= ~0x1; + state.__cpsr |= 0x20; + } #else #error XXX: implement #endif if (sizeof(frame) != 0) - vm_write(task, stack + Stack_ - sizeof(frame), reinterpret_cast(frame), sizeof(frame)); + _krncall(vm_write(task, stack + Stack_ - sizeof(frame), reinterpret_cast(frame), sizeof(frame))); _krncall(thread_set_state(thread, flavor, reinterpret_cast(&state), count)); _krncall(thread_resume(thread));