X-Git-Url: https://git.saurik.com/cycript.git/blobdiff_plain/b166b11b8612a2428d7b86bd3dd27207a3f60dab..4e11a430b3f7d66b06eaf76035834b55ec4f976b:/Mach/Inject.cpp diff --git a/Mach/Inject.cpp b/Mach/Inject.cpp index a2c5f04..0e893a0 100644 --- a/Mach/Inject.cpp +++ b/Mach/Inject.cpp @@ -1,9 +1,46 @@ +/* Cycript - Inlining/Optimizing JavaScript Compiler + * Copyright (C) 2009 Jay Freeman (saurik) +*/ + +/* Modified BSD License {{{ */ +/* + * Redistribution and use in source and binary + * forms, with or without modification, are permitted + * provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the + * above copyright notice, this list of conditions + * and the following disclaimer. + * 2. Redistributions in binary form must reproduce the + * above copyright notice, this list of conditions + * and the following disclaimer in the documentation + * and/or other materials provided with the + * distribution. + * 3. The name of the author may not be used to endorse + * or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, + * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN + * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +*/ +/* }}} */ + #include #include -extern "C" { -#include -} +#include #include #include @@ -14,20 +51,10 @@ extern "C" { #include "Pooling.hpp" #include "Trampoline.t.hpp" -extern "C" void _pthread_set_self(pthread_t); - -template -static void nlset(Type_ &function, struct nlist *nl, size_t index) { - struct nlist &name(nl[index]); - uintptr_t value(name.n_value); - if ((name.n_desc & N_ARM_THUMB_DEF) != 0) - value |= 0x00000001; - function = reinterpret_cast(value); -} +extern "C" void __pthread_set_self(pthread_t); void InjectLibrary(pid_t pid) { - // XXX: break this into the build environment - const char *library("/usr/lib/libcycript.dylib"); + const char *library(CY_LIBRARY); static const size_t Stack_(8 * 1024); size_t length(strlen(library) + 1), depth(sizeof(Baton) + length); @@ -37,16 +64,13 @@ void InjectLibrary(pid_t pid) { uint8_t *local(reinterpret_cast(apr_palloc(pool, depth))); Baton *baton(reinterpret_cast(local)); - struct nlist nl[2]; - memset(nl, 0, sizeof(nl)); - nl[0].n_un.n_name = (char *) "__pthread_set_self"; - nlist("/usr/lib/libSystem.B.dylib", nl); - nlset(baton->_pthread_set_self, nl, 0); + baton->__pthread_set_self = &__pthread_set_self; baton->pthread_create = &pthread_create; baton->pthread_join = &pthread_join; baton->dlopen = &dlopen; + baton->dlerror = &dlerror; baton->dlsym = &dlsym; baton->mach_thread_self = &mach_thread_self; @@ -60,30 +84,57 @@ void InjectLibrary(pid_t pid) { mach_port_t self(mach_task_self()), task; _krncall(task_for_pid(self, pid, &task)); - vm_address_t data; - _krncall(vm_allocate(task, &data, size, true)); - vm_address_t stack(data + depth); - vm_write(task, data, reinterpret_cast(baton), depth); + vm_address_t stack; + _krncall(vm_allocate(task, &stack, size, true)); + vm_address_t data(stack + Stack_); - vm_address_t code; - _krncall(vm_allocate(task, &code, sizeof(Trampoline_), true)); - vm_write(task, code, reinterpret_cast(Trampoline_), sizeof(Trampoline_)); - _krncall(vm_protect(task, code, sizeof(Trampoline_), false, VM_PROT_READ | VM_PROT_EXECUTE)); + vm_write(task, data, reinterpret_cast(baton), depth); thread_act_t thread; _krncall(thread_create(task, &thread)); thread_state_flavor_t flavor; mach_msg_type_number_t count; + size_t push; + + Trampoline *trampoline; #if defined(__arm__) + trampoline = &Trampoline_arm_; arm_thread_state_t state; flavor = ARM_THREAD_STATE; count = ARM_THREAD_STATE_COUNT; + push = 0; +#elif defined(__i386__) + trampoline = &Trampoline_i386_; + i386_thread_state_t state; + flavor = i386_THREAD_STATE; + count = i386_THREAD_STATE_COUNT; + push = 5; +#elif defined(__x86_64__) + trampoline = &Trampoline_x86_64_; + x86_thread_state64_t state; + flavor = x86_THREAD_STATE64; + count = x86_THREAD_STATE64_COUNT; + push = 2; #else #error XXX: implement #endif + vm_address_t code; + _krncall(vm_allocate(task, &code, trampoline->size_, true)); + vm_write(task, code, reinterpret_cast(trampoline->data_), trampoline->size_); + _krncall(vm_protect(task, code, trampoline->size_, false, VM_PROT_READ | VM_PROT_EXECUTE)); + + /* + printf("_ptss:%p\n", baton->__pthread_set_self); + printf("dlsym:%p\n", baton->dlsym); + printf("code:%zx\n", (size_t) code); + */ + + uint32_t frame[push]; + if (sizeof(frame) != 0) + memset(frame, 0, sizeof(frame)); memset(&state, 0, sizeof(state)); mach_msg_type_number_t read(count); @@ -92,18 +143,30 @@ void InjectLibrary(pid_t pid) { #if defined(__arm__) state.r[0] = data; - state.r[1] = RTLD_LAZY | RTLD_GLOBAL; state.sp = stack + Stack_; - state.pc = code; + state.pc = code + trampoline->entry_; if ((state.pc & 0x1) != 0) { state.pc &= ~0x1; state.cpsr |= 0x20; } +#elif defined(__i386__) + frame[1] = data; + + state.__eip = code + trampoline->entry_; + state.__esp = stack + Stack_ - sizeof(frame); +#elif defined(__x86_64__) + frame[0] = 0xdeadbeef; + state.__rdi = data; + state.__rip = code + trampoline->entry_; + state.__rsp = stack + Stack_ - sizeof(frame); #else #error XXX: implement #endif + if (sizeof(frame) != 0) + vm_write(task, stack + Stack_ - sizeof(frame), reinterpret_cast(frame), sizeof(frame)); + _krncall(thread_set_state(thread, flavor, reinterpret_cast(&state), count)); _krncall(thread_resume(thread));