Notes from iOS 89 and the OS X 10.1010.11 Preview

Jonathan Levin, http://newosxbook.com/ - 06/09/15

0. Changelog

6/8/15:First version
7/28/15:Boot-args, 64 bit iOS kernel

Check out @Technologeeks tweets, or the RSS Feed for updates - I'll add more as I go along.. Feel free to shoot any comments/questions to info@.
I'll be covering updated material for OS X 10.11 and iOS 9 at Our iOS/OS X for Reverse Engineers Course on 8/10/2015 in SFO!

About

Another year, another OS. iOS 9 b1 and OS X 10.11 have been announced. I'm in the process of updating Mac OS X and iOS Internals (MOXII) to its 2nd edition - and this should answer you why I set the release date far into October (or a bit later) - at least this way the book will remain up to date for an entire year..

As usual, you need a password and redemption code to download OS X (or have a registered device for iOS 9), but thanks to the great people out there, both are leaked. This is important, because otherwise you need to be on the Apple Developer Program, and the first rule of the Apple Developer Program is you don't talk about the Apple Developer Program Beta software, nor can you reverse engineer. Once more, I almost got suckered into hitting "OK" with that checkbox, but opted out, and got the IPSW/DMG elsewhere. So - I can share my findings here (and of course much more will be in MOXII 2, soon).

This is a VERY rough listing, which tracks what I do to figure out diffs. Commands are raw and largely unedited. This is not meant to be A) comprehensive B) overly legible. You want a simple explanation of diffs, wait for MOXII 2. You want raw findings, read on. Feedback welcome.

Both (XNU)

1. iOS 9

If anyone reading this has, per chance, a 9.0b ARM64 kernel image (unencrypted, of course), I'd *really* appreciate it. I want to update Joker for 64-bit and 9..

2. OS X 10.11

  • More to follow.

    • Boot-args

    Using jtool -d __TEXT.__text kernel.dump | grep PE_parse | grep \" | cut -d\" -f2 | cut -d\" -f1 | sort -u you can get a list of all bootargs (sorted alphabetically and with duplicates suppressed). Comparing the list from a 64-bit iOS 9 kernel with the one yielded by an 8.4 kernel reveals:

    Added:
 -minimalboot
 -no_corpses
 -use_hwpagesize
 arm64_maxoffset
 arm_maxoffset
 assertions
 atm_diagnostic_config
 cpus_defeatures
 pmtimeout
 multiq_drain_ceiling
 radar_20804515
 sched_debug
 statistics
 swd_delay_duration
 swd_delay_type
 swd_kext_name
 swd_timeout
 wql_tsize
 wqp_tsize
 wqt_min_free
 wqt_tbl_size

Removed:
 -vm16k
 maxoffset
 multiq_drain_urgent_first

    Interestingly, in the 32-bit version the args are a tad different - no mention of "swd", for example (which I'm thinking could be the infamous Kernel Patch Protection) (kpp maybe moved to iBoot or Secure Enclave?):

    # Since this is not a diff, these are all the args present in the 32 bit kernel
$ jtool -d __TEXT.__text kernel.9b.4S.decrypted 2>/dev/null  | grep PE_parse_boo | grep \" | cut -d\" -f2 | cut -d\" -f1 | sort -u 
-b
-disable_atm
-l
-minimalboot
-multiq-deep-drain
-no-zp
-no_corpses
-novfscache
-panic_on_exception_triage
-progress
-qos-policy-allow
-s
-vnode_cache_defeat
-x
-zinfop
-zp
_panicd_corename
_panicd_ip
_router_ip
aks_default_class
arm_maxoffset
assert
assertions
atm_diagnostic_config
bg_preempt
colors
debug
diag
disable_exc_resource
fill
hwm_user_cores
ifa_debug
ifnet_debug
imp_interactive_receiver
inaddr_nhash
initmcl
io_throttle_period_tier1
io_throttle_period_tier2
io_throttle_period_tier3
io_throttle_window_tier1
io_throttle_window_tier2
io_throttle_window_tier3
jtag
kdp_crashdump_pkt_size
kdp_match_name
kernel_stack_pages
lcks
lo_txstart
longterm
max_cpumon_interval
max_cpumon_percentage
maxmem
mbuf_debug
mbuf_pool
mcache_flags
mleak_sample_factor
msgbuf
mtxspin
multiq_drain_band_limit
multiq_drain_ceiling
multiq_drain_depth_limit
nbuf
ncl
net.inet.ip.scopedroute
net.inet6.ip6.scopedroute
net_affinity
net_rtref
net_rxpoll
panic_on_cs_killed
panicd_port
pld
preempt
qos_override_mode
rte_debug
sched
sched_debug
sched_decay_usage_age_factor
sched_pri_decay_limit
sched_use_combined_fgbg_decay
serverperfmode
slto_us
socket_debug
task_policy_suppression_disable
task_wakeups_monitor_interval
task_wakeups_monitor_rate
task_wakeups_monitor_ustackshots_trigger_pct
trace
trace_panic
trace_typefilter
trace_wake
vm_compression_limit
vm_compressor
vm_compressor_immediate
vm_compressor_threads
wfi
wql_tsize
wqp_tsize
wqsize
wqt_min_free
wqt_tbl_size
zalloc_debug
zlog
zp-factor
zp-scale
zrecs
zsize