I have 2 questions regarding IOKit KEXTs.
- How does IOMemoryDescriptor deal with memory protection (mprotect/
vm_protect)? Is there a class available to check/change the
protection of certain pages in memory or should i use mprotect/
vm_protect?
- Why do IOKit KEXTs have issues resolving kernel symbols, and what
can i do to work around it. For example if i create a KEXT in C, i
can lookup the address of any symbol which is in /mach.sym, however
I get unresolved symbol errors if i do the same in a IOKit KEXT.
Example HelloIOKit.cpp Code:
...
extern "C" int execve(void *, void *, int *);
...
IOLog("Found execve at %p\n",execve);
...
Example kextload output:
kextload: extension HelloIOKit.kext appears to be valid
kld(): Undefined symbols:
_execve
...
