Notes from iOS
89 and the OS X 10.1010.11 Preview
Jonathan Levin, http://newosxbook.com/ - 06/09/15
|7/28/15:||Boot-args, 64 bit iOS kernel|
I'll be covering updated material for OS X 10.11 and iOS 9 at Our iOS/OS X for Reverse Engineers Course on 8/10/2015 in SFO!
Another year, another OS. iOS 9 b1 and OS X 10.11 have been announced. I'm in the process of updating Mac OS X and iOS Internals (MOXII) to its 2nd edition - and this should answer you why I set the release date far into October (or a bit later) - at least this way the book will remain up to date for an entire year..
As usual, you need a password and redemption code to download OS X (or have a registered device for iOS 9), but thanks to the great people out there, both are leaked. This is important, because otherwise you need to be on the Apple Developer Program, and the first rule of the Apple Developer Program is you don't talk about the
Apple Developer Program Beta software, nor can you reverse engineer. Once more, I almost got suckered into hitting "OK" with that checkbox, but opted out, and got the IPSW/DMG elsewhere. So - I can share my findings here (and of course much more will be in MOXII 2, soon).
32163247(!). That's a leap from 2782/3
- New mac checks: expose_task - used by
mach_port_space_info. also exception port checkes: (_mac_task_check_set_host_exception_port _mac_task_check_set_host_exception_ports _mac_task_check_set_host_special_port), _mac_kext_check_query (ha :-), and _mac_iokit_check_nvram_[get/set/delete]
#define HOST_SYSDIAGNOSE_PORT (16 + HOST_MAX_SPECIAL_KERNEL_PORT) #define HOST_XPC_EXCEPTION_PORT (17 + HOST_MAX_SPECIAL_KERNEL_PORT) #define HOST_CONTAINERD_PORT (18 + HOST_MAX_SPECIAL_KERNEL_PORT)
- The system call table shows several (not 3, as erroneously tweeted by esser) new syscalls:
- netagent_trigger - q.v. new NetAgent Architecture ( netagent_send_error_response, netagent_send_success_response, netagent_unregister_session_wrapper, netagent_send_trigger, netagent_ctl_send, netagent_handle_register, netagent_handle_update, netagent_handle_get, netagent_handle_assert, netagent_handle_unassert, netagent_create_session)
- stack_snapshot_with_config (:-o!)
- microstackshot (OS X only?)
- kevent_qos (374)
- kdebug_trace64 and kdebug_trace_string (178,179)
stack_snapshot(#365) is like my 2nd favorite syscall, and kdebug (#180) is probably my 3rd, and it seems like Apple keeps on augmenting the mechanism.
proc_infonow properly shows what kqueue/kevent is blocking on!
- There are also placeholders for syscalls 494 through 498.
Why? Maybe we'll see in b2..by b7 of OS X there's
work_interval_ctl, as syscall 499.
1. iOS 9
- iBoot 2817. Huge leap from 2263 used in 8.x. And they stripped strings!!! (Congrats Apple, and sucks for the free world)
- ARM exception vector: 0x800c7000 - always a good starting point
- Syscalls in iOS 8+ formatted table (note new ones):
- Kexts (for a 4S - these naturally are a tad different per device type. Looks like Apple has stopped the kec spree that possessed it as of late
- new symbols in the kernel: Not too many, as the diff (below) shows. I've annotated the more interesting ones, but the highlights are:
Caveat: Using a diff method on jtool -S (or nm) potentially misses on symbols that were simply stripped, and not necessarily removed.
- More code signing (
cs_*) symbols to handle code signing blobs
- allocation - kalloc/malloc/etc - are now
- pmc and IOKitDiagnostics class removed (but likely kext'ed - haven't looked into this yet
- More code signing (
2. OS X 10.11
- I liked it better when the code names were feline. Seriously. El Capitan. Capitulate and admit the code names are losing it.. While on the subject, 10.11? Why not just call it OS X 11? or OS XI? Oh, brother.
- mac_proc_check_[get/set]lcid is deprecated, as is apparently the entire notion of a login context.
- fbt and sdt providers removed from DTrace
- Daemons: quick diff here:
- rootless (
/usr/libexec/rootless-init, which apparently is only some sandbox profile pusher (
/System/Library/Sandbox/rootless.compat). Apple calls this "System Integrity Protection". Essentially, it involves a new flag on processes and on files, making them only tamperable (task-for-pid or writable, respectively) if said flag is present. All of Apple's system binaries have this, and files in
/System, /usr/*(save /usr/local) are thus protected. You can bet AMFI has something to do with it.
- Kernel is now in
/System/Library/PrelinkedKernels. As is the custom as of 10.10, the kernel is complzvn compressed. Fortunately, using
kextcachewe can uncompress:
jtool -d __TEXT.__text kernel.dump | grep PE_parse | grep \" | cut -d\" -f2 | cut -d\" -f1 | sort -u you can get a list of all bootargs (sorted alphabetically and with duplicates suppressed). Comparing the list from a 64-bit iOS 9 kernel with the one yielded by an 8.4 kernel reveals:
Added: -minimalboot -no_corpses -use_hwpagesize arm64_maxoffset arm_maxoffset assertions atm_diagnostic_config cpus_defeatures pmtimeout multiq_drain_ceiling radar_20804515 sched_debug statistics swd_delay_duration swd_delay_type swd_kext_name swd_timeout wql_tsize wqp_tsize wqt_min_free wqt_tbl_size Removed: -vm16k maxoffset multiq_drain_urgent_first
Interestingly, in the 32-bit version the args are a tad different - no mention of "swd", for example
(which I'm thinking could be the infamous Kernel Patch Protection) (kpp maybe moved to iBoot or Secure Enclave?):