Notes from iOS 89 and the OS X 10.1010.11 Preview

Jonathan Levin, http://newosxbook.com/ - 06/09/15

0. Changelog

6/8/15:First version
7/28/15:Boot-args, 64 bit iOS kernel

Check out @Technologeeks tweets, or the RSS Feed for updates - I'll add more as I go along.. Feel free to shoot any comments/questions to info@.
I'll be covering updated material for OS X 10.11 and iOS 9 at Our iOS/OS X for Reverse Engineers Course on 8/10/2015 in SFO!

About

Another year, another OS. iOS 9 b1 and OS X 10.11 have been announced. I'm in the process of updating Mac OS X and iOS Internals (MOXII) to its 2nd edition - and this should answer you why I set the release date far into October (or a bit later) - at least this way the book will remain up to date for an entire year..

As usual, you need a password and redemption code to download OS X (or have a registered device for iOS 9), but thanks to the great people out there, both are leaked. This is important, because otherwise you need to be on the Apple Developer Program, and the first rule of the Apple Developer Program is you don't talk about the Apple Developer Program Beta software, nor can you reverse engineer. Once more, I almost got suckered into hitting "OK" with that checkbox, but opted out, and got the IPSW/DMG elsewhere. So - I can share my findings here (and of course much more will be in MOXII 2, soon).

This is a VERY rough listing, which tracks what I do to figure out diffs. Commands are raw and largely unedited. This is not meant to be A) comprehensive B) overly legible. You want a simple explanation of diffs, wait for MOXII 2. You want raw findings, read on. Feedback welcome.

Both (XNU)

1. iOS 9

If anyone reading this has, per chance, a 9.0b ARM64 kernel image (unencrypted, of course), I'd *really* appreciate it. I want to update Joker for 64-bit and 9..

2. OS X 10.11

  • More to follow.
  • Boot-args

    Using jtool -d __TEXT.__text kernel.dump | grep PE_parse | grep \" | cut -d\" -f2 | cut -d\" -f1 | sort -u you can get a list of all bootargs (sorted alphabetically and with duplicates suppressed). Comparing the list from a 64-bit iOS 9 kernel with the one yielded by an 8.4 kernel reveals:

    Added:
     -minimalboot
     -no_corpses
     -use_hwpagesize
     arm64_maxoffset
     arm_maxoffset
     assertions
     atm_diagnostic_config
     cpus_defeatures
     pmtimeout
     multiq_drain_ceiling
     radar_20804515
     sched_debug
     statistics
     swd_delay_duration
     swd_delay_type
     swd_kext_name
     swd_timeout
     wql_tsize
     wqp_tsize
     wqt_min_free
     wqt_tbl_size
    
    Removed:
     -vm16k
     maxoffset
     multiq_drain_urgent_first
    
    

    Interestingly, in the 32-bit version the args are a tad different - no mention of "swd", for example (which I'm thinking could be the infamous Kernel Patch Protection) (kpp maybe moved to iBoot or Secure Enclave?):

    # Since this is not a diff, these are all the args present in the 32 bit kernel
    $ jtool -d __TEXT.__text kernel.9b.4S.decrypted 2>/dev/null  | grep PE_parse_boo | grep \" | cut -d\" -f2 | cut -d\" -f1 | sort -u 
    -b
    -disable_atm
    -l
    -minimalboot
    -multiq-deep-drain
    -no-zp
    -no_corpses
    -novfscache
    -panic_on_exception_triage
    -progress
    -qos-policy-allow
    -s
    -vnode_cache_defeat
    -x
    -zinfop
    -zp
    _panicd_corename
    _panicd_ip
    _router_ip
    aks_default_class
    arm_maxoffset
    assert
    assertions
    atm_diagnostic_config
    bg_preempt
    colors
    debug
    diag
    disable_exc_resource
    fill
    hwm_user_cores
    ifa_debug
    ifnet_debug
    imp_interactive_receiver
    inaddr_nhash
    initmcl
    io_throttle_period_tier1
    io_throttle_period_tier2
    io_throttle_period_tier3
    io_throttle_window_tier1
    io_throttle_window_tier2
    io_throttle_window_tier3
    jtag
    kdp_crashdump_pkt_size
    kdp_match_name
    kernel_stack_pages
    lcks
    lo_txstart
    longterm
    max_cpumon_interval
    max_cpumon_percentage
    maxmem
    mbuf_debug
    mbuf_pool
    mcache_flags
    mleak_sample_factor
    msgbuf
    mtxspin
    multiq_drain_band_limit
    multiq_drain_ceiling
    multiq_drain_depth_limit
    nbuf
    ncl
    net.inet.ip.scopedroute
    net.inet6.ip6.scopedroute
    net_affinity
    net_rtref
    net_rxpoll
    panic_on_cs_killed
    panicd_port
    pld
    preempt
    qos_override_mode
    rte_debug
    sched
    sched_debug
    sched_decay_usage_age_factor
    sched_pri_decay_limit
    sched_use_combined_fgbg_decay
    serverperfmode
    slto_us
    socket_debug
    task_policy_suppression_disable
    task_wakeups_monitor_interval
    task_wakeups_monitor_rate
    task_wakeups_monitor_ustackshots_trigger_pct
    trace
    trace_panic
    trace_typefilter
    trace_wake
    vm_compression_limit
    vm_compressor
    vm_compressor_immediate
    vm_compressor_threads
    wfi
    wql_tsize
    wqp_tsize
    wqsize
    wqt_min_free
    wqt_tbl_size
    zalloc_debug
    zlog
    zp-factor
    zp-scale
    zrecs
    zsize