#include <mach/vm_map.h> #include <stdio.h> #include <mach-o/dyld_images.h> /** * vmmap(1) clone for OS X and iOS * ------------------------------- * * This is a simple example of using the mach_vm_region_info APIs in order to * obtain a process' (technically, a task's) virtual memory address space, in a * manner akin to /proc/[pid]/maps on Linux. * * The process is simple - get the task port, then call mach_vm_region_info until * you've exhausted the address space (in iOS this happens around 0x40000000, * where the commpage is). On iOS 6, for some peculiar reason the task port is * invalidated after each call, so the quick workaround here solves the problem * by regetting the port. The actual mach error code to check for is in the header * files, though the code simply tries regetting. * * N.B - For this code to work, you MUST provide the entitlements to allow * task-for-pid to work, else you'll fail with error 5. The entitlements are in * the output in Chapter 3, but for those of you who haven't bought the book, it would be: * --- Cut here <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.springboard.debugapplications</key> <true/> <key>get-task-allow</key> <true/> <key>proc_info-allow</key> <true/> <key>task_for_pid-allow</key> <true/> <key>run-unsigned-code</key> <true/> </dict> </plist> --- Ok, enough :-) * * so - copy the above XML to a file, say, "ent.xml", and be sure to run "ldid -Sent.xml vmmap" * before trying to run this. You can download the binary (already thus signed) if you're lazy * (and trust me, because you *will* need root on your i-Device for this) * * As the book clearly states, once you have the task port, the world is your oyster. You can * control the entire virtual memory space, reading and writing it as you please. Stay tuned * for the corrupt tool (which will be provided soon in binary form) * */ int g_pid = 0; // required in iOS 6 (read below) /* 03/08/13 - Added List of Mach-O images: */ struct dyld_image_info *g_dii = NULL; int g_imageCount; unsigned char * readProcessMemory (int pid, mach_vm_address_t addr, mach_msg_type_number_t *size) { // Helper function to read process memory (a la Win32 API of same name) // To make it easier for inclusion elsewhere, it takes a pid, and // does the task_for_pid by itself. Given that iOS invalidates task ports // after use, it's actually a good idea, since we'd need to reget anyway task_t t; task_for_pid(mach_task_self(),pid, &t); mach_msg_type_number_t dataCnt = size; vm_offset_t readMem; // Use vm_read, rather than mach_vm_read, since the latter is different // in iOS. kern_return_t kr = vm_read(t, // vm_map_t target_task, addr, // mach_vm_address_t address, *size, // mach_vm_size_t size &readMem, //vm_offset_t *data, size); // mach_msg_type_number_t *dataCnt if (kr) { // DANG.. fprintf (stderr, "Unable to read target task's memory @%p - kr 0x%x\n" , addr, kr); return NULL; } return ( (unsigned char *) readMem); } kern_return_t mach_vm_read (vm_map_t, mach_vm_address_t, mach_vm_size_t, vm_offset_t *, mach_msg_type_number_t *); void findListOfBinaries(task_t t, mach_vm_address_t addr, int size) { kern_return_t kr; mach_msg_type_number_t dataCnt = size; unsigned char *readData = readProcessMemory (g_pid, addr, &dataCnt); int machsig = 0xfeedface; // Checking only 0xfeedfa is a simple way to catch both 64-bit (facf) and 32-bit (face) headers // Machine endianness is automatically taken care of, too.. if (readData && memcmp (readData + 1, ((unsigned char *) &machsig) + 1 , 3) == 0) { // This is a Mach header int i = 0; // A MUCH better way would be to iterate through the LC and find the name of dyld // but this would require my machlib.c (closed source) and really get the same result. // This works because on both iOS and OS X dyld is at /usr/lib. for (i = 0; i <dataCnt; i++) { if (memcmp(readData+i, "lib/dyld", 8) == 0) { unsigned int dyld_all_image_infos_offset ; int imageCount = 0; memcpy (&dyld_all_image_infos_offset, readData+DYLD_ALL_IMAGE_INFOS_OFFSET_OFFSET, sizeof (unsigned int)); struct dyld_all_image_infos *dyldaii ; // Safeguard: should check that dyld_all_image_infos_offset is < size.. if (dyld_all_image_infos_offset > size) { // This is to be expected, since the dyld_all_image_infos is in a data region //printf ("Offset %x is greater than region size : %x\n", dyld_all_image_infos_offset, size); dataCnt = sizeof(dyld_all_image_infos); readData = readProcessMemory (g_pid, addr + dyld_all_image_infos_offset , &dataCnt); if (!readData) { return;} dyldaii = (struct dyld_all_image_infos *) readData; } else { dyldaii = (struct dyld_all_image_infos *) (readData +dyld_all_image_infos_offset); } printf ("Version: %d, %d images at offset %p\n", dyldaii->version, dyldaii->infoArrayCount, dyldaii->infoArray); // Go to dyldaii->infoArray address imageCount = dyldaii->infoArrayCount; dataCnt = imageCount * sizeof(struct dyld_image_info); g_dii = (struct dyld_image_info *) malloc (dataCnt); g_imageCount = imageCount; readData = readProcessMemory(g_pid, dyldaii->infoArray, &dataCnt); if (!readData) { return;} struct dyld_image_info *dii = (struct dyld_image_info *) readData; // We don't need i anymore, anyway for (i = 0; i < imageCount; i++) { dataCnt = 1024; char *imageName = readProcessMemory (g_pid, dii[i].imageFilePath, &dataCnt); if (imageName) g_dii[i].imageFilePath = strdup(imageName); else g_dii[i].imageFilePath = NULL; g_dii[i].imageLoadAddress = dii[i].imageLoadAddress; } break; } } } } /* End 03/08/13 */ char * behavior_to_text (vm_behavior_t b) { switch (b) { case VM_BEHAVIOR_DEFAULT: return("default"); case VM_BEHAVIOR_RANDOM: return("random"); case VM_BEHAVIOR_SEQUENTIAL: return("fwd-seq"); case VM_BEHAVIOR_RSEQNTL: return("rev-seq"); case VM_BEHAVIOR_WILLNEED: return("will-need"); case VM_BEHAVIOR_DONTNEED: return("will-need"); case VM_BEHAVIOR_FREE: return("free-nowb"); case VM_BEHAVIOR_ZERO_WIRED_PAGES: return("zero-wire"); case VM_BEHAVIOR_REUSABLE: return("reusable"); case VM_BEHAVIOR_REUSE: return("reuse"); case VM_BEHAVIOR_CAN_REUSE: return("canreuse"); default: return ("?"); } } char * protection_bits_to_rwx (vm_prot_t p) { // previous version of this somehow lost the "p&", always returning rwx.. static char returned[4]; returned[0] = (p &VM_PROT_READ ? 'r' : '-'); returned[1] = (p &VM_PROT_WRITE ? 'w' : '-'); returned[2] = (p & VM_PROT_EXECUTE ? 'x' : '-'); returned[3] = '\0'; // memory leak here. No biggy return (strdup(returned)); } const char * unparse_inheritance (vm_inherit_t i) { switch (i) { case VM_INHERIT_SHARE: return "share"; case VM_INHERIT_COPY: return "copy"; case VM_INHERIT_NONE: return "none"; default: return "???"; } } macosx_debug_regions (task_t task, mach_vm_address_t address, int max) { kern_return_t kret; mach_vm_address_t prev_address; /* @TODO: warning - potential overflow here - gotta fix this.. */ vm_region_basic_info_data_t prev_info,info; mach_vm_size_t size, prev_size; mach_port_t object_name; mach_msg_type_number_t count; int nsubregions = 0; int num_printed = 0; count = VM_REGION_BASIC_INFO_COUNT_64; kret = mach_vm_region (task, &address, &size, VM_REGION_BASIC_INFO, (vm_region_info_t) &info, &count, &object_name); if (kret != KERN_SUCCESS) { printf ("mach_vm_region: Error %d - %s", kret, mach_error_string(kret)); return; } memcpy (&prev_info, &info, sizeof (vm_region_basic_info_data_t)); prev_address = address; prev_size = size; nsubregions = 1; for (;;) { int print = 0; int done = 0; address = prev_address + prev_size; /* Check to see if address space has wrapped around. */ if (address == 0) { print = done = 1; } if (!done) { // Even on iOS, we use VM_REGION_BASIC_INFO_COUNT_64. This works. count = VM_REGION_BASIC_INFO_COUNT_64; kret = mach_vm_region (task, &address, &size, VM_REGION_BASIC_INFO, (vm_region_info_t) &info, &count, &object_name); if (kret != KERN_SUCCESS) { /* iOS 6 workaround - attempt to reget the task port to avoiD */ /* "(ipc/send) invalid destination port" (1000003 or something) */ task_for_pid(mach_task_self(),g_pid, &task); kret = mach_vm_region (task, &address, &size, VM_REGION_BASIC_INFO, (vm_region_info_t) &info, &count, &object_name); } if (kret != KERN_SUCCESS) { fprintf (stderr,"mach_vm_region failed for address %p - Error: %x\n", address,(kret)); size = 0; if (address >= 0x4000000) return; print = done = 1; } } if (address != prev_address + prev_size) print = 1; if ((info.protection != prev_info.protection) || (info.max_protection != prev_info.max_protection) || (info.inheritance != prev_info.inheritance) || (info.shared != prev_info.reserved) || (info.reserved != prev_info.reserved)) print = 1; if (print) { int print_size; char *print_size_unit; if (num_printed == 0) printf ("Region "); else printf (" ... "); findListOfBinaries(task, prev_address, prev_size); /* Quick hack to show size of segment, which GDB does not */ print_size = prev_size; if (print_size > 1024) { print_size /= 1024; print_size_unit = "K"; } if (print_size > 1024) { print_size /= 1024; print_size_unit = "M"; } if (print_size > 1024) { print_size /= 1024; print_size_unit = "G"; } /* End Quick hack */ printf (" %p-%p [%d%s](%s/%s; %s, %s, %s) %s", (prev_address), (prev_address + prev_size), print_size, print_size_unit, protection_bits_to_rwx (prev_info.protection), protection_bits_to_rwx (prev_info.max_protection), unparse_inheritance (prev_info.inheritance), prev_info.shared ? "shared" : "private", prev_info.reserved ? "reserved" : "not-reserved", behavior_to_text (prev_info.behavior)); if (nsubregions > 1) printf (" (%d sub-regions)", nsubregions); printf ("\n"); prev_address = address; prev_size = size; memcpy (&prev_info, &info, sizeof (vm_region_basic_info_data_t)); nsubregions = 1; num_printed++; } else { prev_size += size; nsubregions++; } if ((max > 0) && (num_printed >= max)) { printf ("Max %d num_printed %d\n", max, num_printed); done = 1; } if (done) break; } } void main(int argc, char **argv) { struct vm_region_basic_info vmr; kern_return_t rc; mach_port_t task; mach_vm_size_t size = 8; vm_region_info_t info = (vm_region_info_t) malloc(10000); mach_msg_type_number_t info_count; mach_port_t object_name; mach_vm_address_t addr =1; int pid; if (!argv[1]) { printf ("Usage: %s <PID>\n"); exit (1);} pid = atoi(argv[1]); g_pid = pid; // req for iOS 6 rc = task_for_pid(mach_task_self(),pid, &task); if (rc) { fprintf (stderr, "task_for_pid() failed with error %d - %s\n", rc, mach_error_string(rc)); exit(1); } printf ("RC %d - Task: %d\n",rc, task); macosx_debug_regions (task, addr, 1000); int i ; for ( i = 0; i < g_imageCount; i++) { printf("Image: %s loaded @%p\n", g_dii[i].imageFilePath, g_dii[i].imageLoadAddress); } printf("Done\n"); }