TODO: MacOS and IOS

[xwings]

MacOS

• Currently on MacOS 13.3
• We ran into AVX and not idea how can we lie dyld saying we are with a CPU without AVX/AVX2
• Maybe recompile dyld without AVX could be a option
• darling project (link below) did mention about commpage and how it specify CPU
• By running the command you should crash at ud2 instruction
• for test run, copy /usr/lib/dyld into rootfs/x8664_macos/usr/lib and all the required dylib

To test, run:

cd examples
python3 ../qltool run -f rootfs/x8664_macos/bin/x8664_hello --rootfs=rootfs/x8664_macos --output="debug"

iOS

• IOS 13.3.1
• replied two empty syscall fgetattrlist(228) and poll(230)
• fail at thread_selfid=0x80,372,0
• for test run, copy /usr/lib/dyld into rootfs/arm64_ios/usr/lib

To test, run:

cd examples
python3 ../qltool run -f rootfs/arm64_ios/bin/arm64_hello_asm --rootfs=rootfs/arm64_ios/

[xwings]

Loader Possible Reference

• https://github.com/shinh/maloader
• https://github.com/patriotyk/dyld
• https://github.com/espes/Slave-in-the-Magic-Mirror/blob/5a80c28824e804c6b526b65bbb84089f3b9d5391/loader.py
• https://github.com/ronaldoussoren/macholib

IOS Related Reference

• https://github.com/Coalfire-Research/iOS-11.1.2-15B202-Jailbreak/
• https://github.com/zydeco/aah
• https://wiki.libav.org/Platform/iOS#arm64
• https://github.com/radareorg/radare2/blob/master/libr/syscall/d/ios-arm-64.sdb.txt

MACHO Documentation

• https://github.com/kpwn/iOSRE/blob/master/wiki/Mach-O.md
• https://wiki.darlinghq.org/documentation:commpage
• https://github.com/darlinghq/darling/blob/master/kernel-include/i386/cpu_capabilities.h

Others

• https://wiki.darlinghq.org/debugging

[xwings]

Compile option could be:

gcc -march=native -E -v - </dev/null 2>&1 | grep cc1

/usr/libexec/gcc/x86_64-pc-linux-gnu/5.3.0/cc1 -E -quiet -v - -march=sandybridge 
-mmmx -mno-3dnow -msse -msse2 -msse3 -mssse3 -mno-sse4a -mcx16 
-msahf -mno-movbe -maes -mno-sha -mpclmul -mpopcnt -mno-abm -mno-lwp 
-mno-fma -mno-fma4 -mno-xop -mno-bmi -mno-bmi2 -mno-tbm -mavx 
-mno-avx2 -msse4.2 -msse4.1 -mno-lzcnt -mno-rtm -mno-hle -mno-rdrnd 
-mno-f16c -mno-fsgsbase -mno-rdseed -mno-prfchw -mno-adx -mfxsr 
-mxsave -mxsaveopt -mno-avx512f -mno-avx512er -mno-avx512cd 
-mno-vx512pf -mno-prefetchwt1 -mno-clflushopt -mno-xsavec -mno-xsaves 
-mno-avx512dq -mno-avx512bw -mno-avx512vl -mno-avx512ifma 
-mno-avx512vbmi -mno-clwb -mno-pcommit -mno-mwaitx --param 
l1-cache-size=32 --param l1-cache-line-size=64 --param 
l2-cache-size=3072 -mtune=sandybridge -fstack-protector-strong

[xwings]

[+] 0x500001178        9a 20 01 94                   bl #0x5000493e0
[+] 0x5000493e0        f4 4f be a9                   stp x20, x19, [sp, #-0x20]!
[+] 0x5000493e4        fd 7b 01 a9                   stp x29, x30, [sp, #0x10]
[+] 0x5000493e8        fd 43 00 91                   add x29, sp, #0x10
[+] 0x5000493ec        f3 00 00 f0                   adrp x19, #0x500068000
[+] 0x5000493f0        68 22 46 39                   ldrb w8, [x19, #0x188]
[+] 0x5000493f4        88 00 00 37                   tbnz w8, #0, #0x500049404
[+] 0x5000493f8        07 00 00 94                   bl #0x500049414
[+] 0x500049414        fd 7b bf a9                   stp x29, x30, [sp, #-0x10]!
[+] 0x500049418        fd 03 00 91                   mov x29, sp
[+] 0x50004941c        45 01 00 94                   bl #0x500049930
[+] 0x500049930        70 03 80 92                   movn x16, #0x1b
[+] 0x500049934        01 10 00 d4                   svc #0x80
fgetattrlist(fd: 0, attrlist: 0x500068700, attrbuff: 0x5000a001c, attrsizebuff: 0x7ffd099ffb8f, options: 0x10)
[+] 0x500049938        c0 03 5f d6                   ret
[+] 0x500049420        e8 00 00 f0                   adrp x8, #0x500068000
[+] 0x500049424        00 95 01 b9                   str w0, [x8, #0x194]
[+] 0x500049428        3c 01 00 94                   bl #0x500049918
[+] 0x500049918        30 03 80 92                   movn x16, #0x19
[+] 0x50004991c        01 10 00 d4                   svc #0x80
pool()
[+] 0x500049920        c0 03 5f d6                   ret
[+] 0x50004942c        e8 00 00 f0                   adrp x8, #0x500068000
[+] 0x500049430        08 31 06 91                   add x8, x8, #0x18c
[+] 0x500049434        00 01 00 b9                   str w0, [x8]
[+] 0x500049438        e8 00 00 f0                   adrp x8, #0x500068000
[+] 0x50004943c        09 c1 41 b9                   ldr w9, [x8, #0x1c0]
[+] 0x500049440        a9 01 00 35                   cbnz w9, #0x500049474
[+] 0x500049444        e9 4f 70 b2                   orr x9, xzr, #0xfffff0000
[+] 0x500049448        a9 04 98 f2                   movk x9, #0xc025
[+] 0x50004944c        29 49 40 39                   ldrb w9, [x9, #0x12]
[+] 0x500049450        09 c1 01 b9                   str w9, [x8, #0x1c0]
[+] 0x500049454        e8 03 00 32                   orr w8, wzr, #1
[+] 0x500049458        08 21 c9 1a                   lsl w8, w8, w9
[+] 0x50004945c        08 7d 40 93                   sxtw x8, w8
[+] 0x500049460        e9 00 00 f0                   adrp x9, #0x500068000
[+] 0x500049464        28 d9 00 f9                   str x8, [x9, #0x1b0]
[+] 0x500049468        08 05 00 d1                   sub x8, x8, #1
[+] 0x50004946c        e9 00 00 f0                   adrp x9, #0x500068000
[+] 0x500049470        28 dd 00 f9                   str x8, [x9, #0x1b8]
[+] 0x500049474        e8 00 00 f0                   adrp x8, #0x500068000
[+] 0x500049478        09 a9 41 b9                   ldr w9, [x8, #0x1a8]
[+] 0x50004947c        a9 01 00 35                   cbnz w9, #0x5000494b0
[+] 0x500049480        e9 4f 70 b2                   orr x9, xzr, #0xfffff0000
[+] 0x500049484        a9 04 98 f2                   movk x9, #0xc025
[+] 0x500049488        29 01 40 39                   ldrb w9, [x9]
[+] 0x50004948c        09 a9 01 b9                   str w9, [x8, #0x1a8]
[+] 0x500049490        e8 03 00 32                   orr w8, wzr, #1
[+] 0x500049494        08 21 c9 1a                   lsl w8, w8, w9
[+] 0x500049498        08 7d 40 93                   sxtw x8, w8
[+] 0x50004949c        e9 00 00 f0                   adrp x9, #0x500068000
[+] 0x5000494a0        28 cd 00 f9                   str x8, [x9, #0x198]
[+] 0x5000494a4        08 05 00 d1                   sub x8, x8, #1
[+] 0x5000494a8        e9 00 00 f0                   adrp x9, #0x500068000
[+] 0x5000494ac        28 d1 00 f9                   str x8, [x9, #0x1a0]
[+] 0x5000494b0        2a 03 00 94                   bl #0x50004a158
[+] 0x50004a158        c0 03 5f d6                   ret
[+] 0x5000494b4        00 00 80 d2                   movz x0, #0
[+] 0x5000494b8        fd 7b c1 a8                   ldp x29, x30, [sp], #0x10
[+] 0x5000494bc        1f fa ff 17                   b #0x500047d38
[+] 0x500047d38        f4 4f be a9                   stp x20, x19, [sp, #-0x20]!
[+] 0x500047d3c        fd 7b 01 a9                   stp x29, x30, [sp, #0x10]
[+] 0x500047d40        fd 43 00 91                   add x29, sp, #0x10
[+] 0x500047d44        80 00 00 b5                   cbnz x0, #0x500047d54
[+] 0x500047d48        fd 7b 41 a9                   ldp x29, x30, [sp, #0x10]
[+] 0x500047d4c        f4 4f c2 a8                   ldp x20, x19, [sp], #0x20
[+] 0x500047d50        12 00 00 14                   b #0x500047d98
[+] 0x500047d98        fd 7b bf a9                   stp x29, x30, [sp, #-0x10]!
[+] 0x500047d9c        fd 03 00 91                   mov x29, sp
[+] 0x500047da0        67 10 00 94                   bl #0x50004bf3c
[+] 0x50004bf3c        90 2e 80 d2                   movz x16, #0x174
[+] 0x50004bf40        01 10 00 d4                   svc #0x80
thread_selfid() = 123
[+] 0x50004bf44        e3 00 00 54                   b.lo #0x50004bf60
[+] 0x50004bf48        fd 7b bf a9                   stp x29, x30, [sp, #-0x10]!
[+] 0x50004bf4c        fd 03 00 91                   mov x29, sp
[+] 0x50004bf50        30 f7 ff 97                   bl #0x500049c10
[+] 0x500049c10        f4 4f be a9                   stp x20, x19, [sp, #-0x20]!
[+] 0x500049c14        fd 7b 01 a9                   stp x29, x30, [sp, #0x10]
[+] 0x500049c18        fd 43 00 91                   add x29, sp, #0x10
[+] 0x500049c1c        f3 03 00 aa                   mov x19, x0
[+] 0x500049c20        8d f9 ff 97                   bl #0x500048254
[+] 0x500048254        f4 4f be a9                   stp x20, x19, [sp, #-0x20]!
[+] 0x500048258        fd 7b 01 a9                   stp x29, x30, [sp, #0x10]
[+] 0x50004825c        fd 43 00 91                   add x29, sp, #0x10
[+] 0x500048260        08 1c 00 12                   and w8, w0, #0xff
[+] 0x500048264        09 01 00 b0                   adrp x9, #0x500069000
[+] 0x500048268        29 11 1f 91                   add x9, x9, #0x7c4
[+] 0x50004826c        29 01 40 b9                   ldr w9, [x9]
[+] 0x500048270        1f 11 00 71                   cmp w8, #4
[+] 0x500048274        24 09 40 7a                   ccmp w9, #0, #4, eq
[+] 0x500048278        a0 00 00 54                   b.eq #0x50004828c
[+] 0x50004828c        fd 7b 41 a9                   ldp x29, x30, [sp, #0x10]
[+] 0x500048290        f4 4f c2 a8                   ldp x20, x19, [sp], #0x20
[+] 0x500048294        c0 03 5f d6                   ret
[+] 0x500049c24        e0 03 13 aa                   mov x0, x19
[+] 0x500049c28        f0 ff ff 97                   bl #0x500049be8
[+] 0x500049be8        08 01 00 b0                   adrp x8, #0x50006a000
[+] 0x500049bec        00 f1 08 b9                   str w0, [x8, #0x8f0]
[+] 0x500049bf0        68 d0 3b d5                   mrs x8, tpidrro_el0
[+] 0x500049bf4        08 f1 7d 92                   and x8, x8, #0xfffffffffffffff8
[+] 0x500049bf8        08 05 40 f9                   ldr x8, [x8, #8]
[+] 0x500049bfc        48 00 00 b4                   cbz x8, #0x500049c04
[+] 0x500049c04        00 00 80 92                   movn x0, #0
[+] 0x500049c08        01 00 80 92                   movn x1, #0
[+] 0x500049c0c        c0 03 5f d6                   ret
[+] 0x500049c2c        00 00 80 92                   movn x0, #0
[+] 0x500049c30        01 00 80 92                   movn x1, #0
[+] 0x500049c34        fd 7b 41 a9                   ldp x29, x30, [sp, #0x10]
[+] 0x500049c38        f4 4f c2 a8                   ldp x20, x19, [sp], #0x20
[+] 0x500049c3c        c0 03 5f d6                   ret
[+] 0x50004bf54        bf 03 00 91                   mov sp, x29
[+] 0x50004bf58        fd 7b c1 a8                   ldp x29, x30, [sp], #0x10
[+] 0x50004bf5c        c0 03 5f d6                   ret
[+] 0x500047da4        08 01 00 d0                   adrp x8, #0x500069000
[+] 0x500047da8        00 6d 04 f9                   str x0, [x8, #0x8d8]
[+] 0x500047dac        1f 04 00 b1                   cmn x0, #1
[+] 0x500047db0        40 01 00 54                   b.eq #0x500047dd8
[+] 0x500047dd8        f4 57 bf a9                   stp x20, x21, [sp, #-0x10]!
[+] 0x500047ddc        d4 00 00 90                   adrp x20, #0x50005f000
[+] 0x500047de0        94 c6 33 91                   add x20, x20, #0xcf1
[+] 0x500047de4        15 01 00 b0                   adrp x21, #0x500068000
[+] 0x500047de8        b5 22 05 91                   add x21, x21, #0x148
[+] 0x500047dec        b4 06 00 f9                   str x20, [x21, #8]
[+] 0x500047df0        f4 57 c1 a8                   ldp x20, x21, [sp], #0x10
[+] 0x500047df4        20 00 20 d4                   brk #0x1
[!] Trap Found
[!] Emulation Error


[-] x0  :        0xffffffffffffffff
[-] x1  :        0xffffffffffffffff
[-] x2  :        0x5000a001c
[-] x3  :        0x7ffd099ffb8f
[-] x4  :        0x10
[-] x5  :        0x1
[-] x6  :        0x7ffd099ffc50
[-] x7  :        0xda0
[-] x8  :        0x500069000
[-] x9  :        0x0
[-] x10 :        0x500000000
[-] x11 :        0xa0000
[-] x12 :        0x50
[-] x13 :        0x3c000
[-] x14 :        0x0
[-] x15 :        0x0
[-] x16 :        0x174
[-] x17 :        0x0
[-] x18 :        0x0
[-] x19 :        0x500068000
[-] x20 :        0x7ffd099ffea0
[-] x21 :        0x100000000
[-] x22 :        0x1
[-] x23 :        0x500000000
[-] x24 :        0x7ffd099ffe18
[-] x25 :        0x500069590
[-] x26 :        0x7ffd099ffdf0
[-] x27 :        0x0
[-] x28 :        0x7ffd099ffe90
[-] x29 :        0x7ffd099ffd50
[-] x30 :        0x500047da4
[-] sp  :        0x7ffd099ffd50
[-] pc  :        0x500047df4
[-] cpacr_el1   :        0x300000


[+] PC = 0x500047df4
[+] Start      End        Perm.  Path
[+] 00000000 - 00001000 - rwx    [__PAGEZERO]
[+] 100000000 - 100008000 - rwx    [loadSegment64]
[+] 100008000 - 10000c000 - rwx    [loadSegment64]
[+] 10000c000 - 100010000 - rwx    [loadSegment64]
[+] 100010000 - 100014000 - rwx    [loadSegment64]
[+] 500000000 - 500064000 - rwx    [loadSegment64]
[+] 500064000 - 500068000 - rwx    [loadSegment64]
[+] 500068000 - 50006c000 - rwx    [loadSegment64]
[+] 50006c000 - 5000a0000 - rwx    [loadSegment64]
[+] 5000a0000 - 5000dc000 - rwx    [loadSegment64]
[+] fffffc000 - fffffd000 - rwx    [commpage]
[+] 7ffcf0000000 - 7ffd09a00000 - rwx    [stack]


[+] ['0x20', '0x0', '0x20', '0xd4', '0xfd', '0x7b', '0xbf', '0xa9']


[+] 0x500047df4        20 00 20 d4 fd 7b bf a9 fd 03 00 91 08 00 80 d2 09 01 00 b0 29 61 06 91 29 01 40 f9 e9 03 09 cb aa 03 00 ca 5f 01 09 ea 61 00 00 54 e8 0f 40 d1 1f 01 00 91 01 00 00 94 ff c3 01 d1 fc 6f 01 a9 brk #0x1
stp x29, x30, [sp, #-0x10]!
mov x29, sp
movz x8, #0
adrp x9, #0x500068000
add x9, x9, #0x198
ldr x9, [x9]
neg x9, x9
eor x10, x29, x0
tst x10, x9
b.ne #0x500047e28
sub x8, sp, #3, lsl #12
mov sp, x8
bl #0x500047e2c
sub sp, sp, #0x70
stp x28, x27, [sp, #0x10]