August 2007 - Darwin-dev - lists.apple.com

Re: Rereading A Partition Table
by Duane Murphy 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com --- At Thu, 16 Aug 2007 10:53:50 -0400, Dan Markarian wrote: >Hey Duane, > >We do not detect live changes to a partition map in Tiger. Thanks. Then I am back to my original question. When Disk Utility (diskutil) partitions a drive it takes it off-line then puts it back on- line. Clearly this causes everything to be re-read. I'd like to do the same thing. Disk Arbitration doesn't seem quite the right tool for doing this. In fact even Disk Utility does not fully "eject" a firewire disk unless it is partitioning. I surely don't want to request the user to restart just to re-read changes to a disk. Is there somewhere I should look for how to do this? Another mailing list? Thanks for the help. >On 15 Aug 2007, at 9:58 PM, Duane Murphy wrote: > >> --- At Wed, 15 Aug 2007 17:26:42 -0700, Chris Sarcone wrote: >> >>> Duane -- >>> >>> I'm making changes to GUID partition disks partition table, and I >>> would >>> like the system to re-read the disk in order to recognize new >>> partitions >>> on the disk. >>> >>> What do I need to do to get the system to re-read the disk and >>> recognize >>> the changes? >>> >>> I've tried several disk util commands (unmountDisk, mountDisk, and >>> eject) but they don't re-read the disk. >>> >>> Disk Utility->Eject does the same thing (ie nothing). >>> >>> I note that this is a FireWire drive, but it could also be an >>> internal >>> drive or any other non-network drive. >>> >>> For example, when Disk Utility partitions a disk, it fully unmounts >>> and >>> then remounts the disk. How can I do the same thing? >>> >>> Try opening and closing the raw disk node for the whole device. >>> >> >> Hi Chris, >> That's what I was told. In fact, I am editing the partition table >> using / >> dev/rdisk1 >> (or whatever number). But when it is closed it doesn't do anything. >> >> Here's how I open. inDisk is "/dev/rdisk1" (for example); >> int diskDescriptor >> = open( inDisk, O_RDWR | O_SHLOCK, S_IRUSR | S_IWUSR | S_IRGRP ); >> >> later I just >> >> close( diskDescriptor ); >> >> There's no errors and in fact, the disk is nicely edited. If I unplug >> the drive and plug it back in the partitions looks exactly like what I >> want, but it's hard to do that for internal disks. :-) ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Rereading A Partition Table
by Dan Markarian 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hey Duane, We do not detect live changes to a partition map in Tiger. Dan On 15 Aug 2007, at 9:58 PM, Duane Murphy wrote: --- At Wed, 15 Aug 2007 17:26:42 -0700, Chris Sarcone wrote: Duane -- I've tried several disk util commands (unmountDisk, mountDisk, and eject) but they don't re-read the disk. Disk Utility->Eject does the same thing (ie nothing). Try opening and closing the raw disk node for the whole device. Here's how I open. inDisk is "/dev/rdisk1" (for example); int diskDescriptor = open( inDisk, O_RDWR | O_SHLOCK, S_IRUSR | S_IWUSR | S_IRGRP ); later I just close( diskDescriptor ); There's no errors and in fact, the disk is nicely edited. If I unplug the drive and plug it back in the partitions looks exactly like what I want, but it's hard to do that for internal disks. :-) ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I'm making changes to GUID partition disks partition table, and I would like the system to re-read the disk in order to recognize new partitions on the disk. What do I need to do to get the system to re-read the disk and recognize the changes? I note that this is a FireWire drive, but it could also be an internal drive or any other non-network drive. For example, when Disk Utility partitions a disk, it fully unmounts and then remounts the disk. How can I do the same thing? Hi Chris, That's what I was told. In fact, I am editing the partition table using / dev/rdisk1 (or whatever number). But when it is closed it doesn't do anything. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/markarian %40apple.com This email sent to markarian(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Changing source port in reflector module
by virgile garcia 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:mime-version:content-type:x-google-sender-auth; b=LF1CMa8v/7HJnIxSl4giTNvdkVLLEqHYJFsIsZ5miF62s+DZUQQxHJsi4Hr0crMjn/5NWbN+QByjXDtcYKIZkF9sKv7b6e7Rhu5ONYfMf0JdeZDc7ponM7ufE47dOz2d5xikTsm95IldCBdS/MNqipUlTjNzcseojUUKBqZaKW8= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:sender:to:subject:mime-version:content-type:x-google-sender-auth; b=n8ZnAJFMks777WXgu5yPtsWrYdbB6eLurKL2Hyc7OtCzSIvLVZIR5FSbNW2fSD1XKYxIHHEWdy6wNMiZpocwMnKWkEoQXDYpHeObl3QIZQuVLhdCRKzzuPqVX6vgTrQRpvyznQPCVffPo6JTYz3BR+IqANddIDfzcs0JY/1jtc8= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Shawn Erickson 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=alh7NquUHEtmXJWXC8CM294XhB9rAZ1BzLVxM4sOjwQ2y9s8OkjqEvDYVwFEJBlRn7vfwm1ygXl0iBGRIVq1Gn7Gj+BgCCRCmIE7otTKXq7TZ5GpI5AqiayjENQCMVF6+gPg/a/4ge0wk8xF4u/j7/B8lbz2VNklr93cYlgrtN0= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=R/1LCmNf8GQqD4JSmWHurskkMZ+K6GwKclpmJ7yfMUf2AbHHQ19Fvt+4DU6TNzl0UVEU/QdmaC/yY4fwDPmnkl5TL1RqPAT0x0h7474p1t15+TBPbkcHnN3lN2pp5aycGo0JxKc2myKCFOcnOzEWDCXCkmqZxxwVWc686wEfH9A= On 8/15/07, Matt Burnett <matt.w.burnett(a)gmail.com> wrote: > Regarding the whole kernel hook abuse issue. I think this could have > a much better solution than security though obscurity. There are > several articles in Phrack magazine on how to do this with previous > versions of OS X and other similar OSes. I too figured out how to do > this on current versions of OS X. I think you misunderstand what Terry stated. This isn't a security feature. This is Apple marking things that developers shouldn't use as private, etc... Apple doesn't want to support this type activity by developers at this time (likely ever). Instead you (and others) should be outlining what you need/want to do conceptually (not how you think you need to do it) so that Apple can better understand what types of _supported_ API they need to provide. I know you likely need to get things done so sometimes doing things the wrong / unsupported way is the only short term solution but it is your interest to file enhancement/defect requests with Apple about the missing API that you need (again try to describe the problem domain of your product as best you can when doing so). -Shawn _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Question
by Amanda Walker 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Amanda Walker _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 16, 2007, at 2:45 AM, Matt Burnett wrote: I think the preceding threads prove my point that there is a demand from the development community to provide kernel hooks even if the interface is volatile. There is demand for KPIs. "Kernel Hooks" are a workaround when a KPI doesn't exist, not a solution, because they rely by definition on a particular implementation. Just the phrase "patching syscalls" involves making many implementation assumptions. . If Apple doesn't provide one, then that makes me think they dont want to because it could destroy the user expierence with kernel panics. No. It means that they want to be free to improve the kernel without breaking other things. The downside to that is, if Apple doesn't provide a regulated but liberal interface into the kernel the developers will create their own. And their products will break. Often. This happens even in user mode--look at the messes created by Application Enhancer. lol, should i be impressed with your email address as well? Well, you're the one who asked for assistance, and got the answer "the approach you describe is a bad idea" from people with a lot of experience. Nobody can stop you from doing whatever you want, of course. We can only suggest that it's likely to be an unrewarding way to go about it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Disk Arbitration: Preventing the disk insertion (unrecognized volume) dialog
by Dan Markarian 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hey Ron, Dan On 15 Aug 2007, at 9:05 PM, Ron Aldrich wrote: Folks, I register a disk appeared callback to the Disk Arbitration framework. This is where things go bad. The driver creates an IOMedia object for the freshly formatted disk. My disk appeared callback gets called. So, how should I be intercepting that dialog? Thanks for your time, Ron Aldrich Software Architects, Inc. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… You must use DADiskPeekCallback() to issue the DADiskClaim() ahead of time. I'm working on a disk formatting utility to support some specialized media and file system types, and I'm running into a bit of a problem with Disk Arbitration. I don't seem to be able to prevent the disk insertion (unrecognized volume) dialog from appearing after I issue a low-level format call to the device. Currently, I use diskutil to unmount the disk (if it was mounted - it's possible that there is unformatted media in the drive, and therefore no IOMedia object). I then ask the driver to format the media - if it had an IOMedia object, it tears it down, and formats the disk, and re-enables polling. In the disk appeared callback, I call DADiskClaim, in an attempt to prevent the unrecognized volume dialog from appearing. Apparently it's too late at this point. My diskClaimed callback gets called, the disk gets partitioned, and everything proceeds normally, except that there is an unwanted dialog on the screen. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/markarian %40apple.com This email sent to markarian(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Question
by Michael Smith 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Aug 15, 2007, at 11:45 PM, Matt Burnett wrote: = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… As has clearly been articulated in both this thread and many others preceding, this has nothing to do with security. It is a matter of providing sustainable interfaces to developers and techniques for managing situations where interfaces have to change in a graceful fashion. I think the preceding threads prove my point that there is a demand from the development community to provide kernel hooks even if the interface is volatile. That there are demands is clear. The significance of these demands is open to debate, and the DTS folks are probably in the best position to comment on that, as they deal with Apple's developer community on a daily basis. It's not unreasonable to assume that you aren't the first person to raise these issues, and perhaps it would help for you to understand more fully how things have reached the point they are currently at. If Apple doesn't provide one, then that makes me think they dont want to because it could destroy the user expierence with kernel panics. You could read the several justifications offered in this thread and others by engineers that have worked on, or are still working on, the issues, rather than guessing. You are of course welcome to remain uninformed, but it doesn't help your case. The downside to that is, if Apple doesn't provide a regulated but liberal interface into the kernel the developers will create their own. With my proposed plan at least gives the user fair warning, whereas the present solution requires me to hook it manually, leaving the possibility i would never inform the user of the hook and the resulting panics being perceived by the user to be Apple's fault. A sensible developer with care for their customers would not do this. If you have a need for an interface that the system doesn't expose, your first stop should be with DTS or the Apple engineers on this list, and you would need to realise that you're not the only stakeholder in the game. If you can't do what you want in the way that you think you should, perhaps you need to look for a different way, or perhaps you need to accept that it cannot be done... Terry did say that "We hide system calls so someone unscrupulous..." can't hook them. The act of hiding something from a unscrupulous person directly implies the act of hiding to be a security measure, see my first reply to him for a definition of unscrupulous. Whilst that may well be a definition of the term, you have incorrectly interpreted what Terry was attempting to communicate. This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Question
by Matt Burnett 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=W6wcOdbqr0d15oZSvxlvRYVwqMFvxvRvM9bng1z4TqcLG+2O8vwRf3C4DKXAnjEoOTTwRfzCUf8arx8hrnnDOYeabkGg5JhudCX8cRXvoUhKeKRgIjRfi+QbRy14StIV9xhisAM9p7Cp+LV8YtFfkM6Nd6TPM1iR4PmFU+B/tyc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=dGYgknjV7leo4dKFF8kL3k6hJ5a7zCjaJUjnkx6qKMFfA2uB4cnzgto/42N5Fkam0nLIk1FBsksVFepCpQIbQIU1FGdDSxcLhrnv4J7tXjH107AJKKI1RcTqcg/jyu+gxVPn4cyNEzc5MuA+lKQ5ex3Gqaw/Yb5oZ/4/KqQU1x4= Thanks for the info. lol, should i be impressed with your email address as well? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 16, 2007, at 1:16 AM, Michael Smith wrote: It does not, beyond causing the failure of operations requesting directions that would violate the task's mapping protections. The sort of operation you're describing is not part of the operation model for any I/O Kit driver or family, so no, there are not. As a general rule, tasks don't expect operations to have that sort of permanent side-effect - there are interfaces that they may call if it's what they want. It is, of course, possible to remap client address ranges in the kernel with differing protections. This is documented in the literature and has been widely discussed here and on other Darwin lists. I/O Kit kexts are linked against the symbol sets on which they declare dependencies. This facilitates a number of useful and largely invisible features. ... which would of course prove the point that you mistakenly think Terry was making, beyond any contradiction. As has clearly been articulated in both this thread and many others preceding, this has nothing to do with security. It is a matter of providing sustainable interfaces to developers and techniques for managing situations where interfaces have to change in a graceful fashion. I think the preceding threads prove my point that there is a demand from the development community to provide kernel hooks even if the interface is volatile. If Apple doesn't provide one, then that makes me think they dont want to because it could destroy the user expierence with kernel panics. The downside to that is, if Apple doesn't provide a regulated but liberal interface into the kernel the developers will create their own. With my proposed plan at least gives the user fair warning, whereas the present solution requires me to hook it manually, leaving the possibility i would never inform the user of the hook and the resulting panics being perceived by the user to be Apple's fault. Terry did say that "We hide system calls so someone unscrupulous..." can't hook them. The act of hiding something from a unscrupulous person directly implies the act of hiding to be a security measure, see my first reply to him for a definition of unscrupulous. I'm sure if you were to check Terry's e-mail address you would in fact find that he is paid on a daily basis to come up with better ideas than yours, and perhaps it would be worth your while to sit back for a bit and think about what has actually been said in this thread, and the many on related subjects prior, before leaping back into the fray. This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Question
by Michael Smith 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Aug 15, 2007, at 10:35 PM, darwin-dev-request(a)lists.apple.com wrote: I have 2 questions regarding IOKit KEXTs. - How does IOMemoryDescriptor deal with memory protection (mprotect/ vm_protect)? Is there a class available to check/change the protection of certain pages in memory or should i use mprotect/ vm_protect? - Why do IOKit KEXTs have issues resolving kernel symbols, and what can i do to work around it. For example if i create a KEXT in C, i can lookup the address of any symbol which is in /mach.sym, however I get unresolved symbol errors if i do the same in a IOKit KEXT. I would like to remind you that hurling insults at me such as "unscrupulous" (definition: having or showing no moral principles; not honest or fair) does nothing other than provoke me to release a SDK to the public which would allow people to hook kernel functions. Regarding the whole kernel hook abuse issue. I think this could have a much better solution than security though obscurity. When i was trying to figure out how to hook function calls i looked all over apple's dev lists and saw plenty of other people asking the same question, im sure you know this is a demand from developers to do this. Im sure if you spent some time on it you could think of a better idea than mine and one much better than saying it cant/ shouldnt be done. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Taking advantage of the digest to respond to several parts of the thread separately... It does not, beyond causing the failure of operations requesting directions that would violate the task's mapping protections. The sort of operation you're describing is not part of the operation model for any I/O Kit driver or family, so no, there are not. As a general rule, tasks don't expect operations to have that sort of permanent side-effect - there are interfaces that they may call if it's what they want. It is, of course, possible to remap client address ranges in the kernel with differing protections. This is documented in the literature and has been widely discussed here and on other Darwin lists. I/O Kit kexts are linked against the symbol sets on which they declare dependencies. This facilitates a number of useful and largely invisible features. ... which would of course prove the point that you mistakenly think Terry was making, beyond any contradiction. As has clearly been articulated in both this thread and many others preceding, this has nothing to do with security. It is a matter of providing sustainable interfaces to developers and techniques for managing situations where interfaces have to change in a graceful fashion. I'm sure if you were to check Terry's e-mail address you would in fact find that he is paid on a daily basis to come up with better ideas than yours, and perhaps it would be worth your while to sit back for a bit and think about what has actually been said in this thread, and the many on related subjects prior, before leaping back into the fray. This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Matt Burnett 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=bCDqAUN3vonnKeQAHmq9RV7626or2yFnHFt0UyoSluk3sAaOp1lYCgP0eik8nEDQYgzlnKiaAsWntArhbhHPc5e3LidkZvgdGZZYayqnstD0NAGEwjgO9TDy3iad4tMMbbW9b+RL/a/zH7wZ/6G02vCRc8P6EmwBkFd8cDRfwg8= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=G6BMQdO93Uv+4mLDIFhtb6HoD37Fq03YV7MReRMcSBEpucHdBMq28mH6ID1GQETGJ/MwTZjkRDYyv6Mc6f+wzScmJm+Bmz03SSWtc0kjujosfKuvMTtjzPbUVXubOCRlt0OUjtnBcpe3ygCjtvwuRvWteK8meJWlYQt5P6zzVaM= -Matt Burnett On Aug 15, 2007, at 10:24 PM, Terry Lambert wrote: No, there are not. Your best bet is to deal with this from user space instead. Expect that this could break in software updates. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Getting the right VM Map for a specific task/process isn't hard. As far as 64 bit systems and mach_vm_protect, i can still use it, its exported at 0x1831F5 on 10.4.10 Intel. What i am trying to do can NOT be done from user space, my intent is to hook kernel functions and do all sorts of things that cause kernel panics. I didn't ask about any symbols that were not exported (sysent), i asked about symbols that were exported (execve). It doesn't matter if you dont export the symbol, i can still find it, for example nsysent comes right after sysent, i can calculate sysent's address from nsysent's address. Also the sysent structure could be found though brute force methods as well. I know what i am trying to do will produce code that may or may not work on past or future versions of darwin/os x. Even if i did release this code, it would be trivial to check the current version of OS X and auto-disable the extension. I would also like to make it clear that i have all ready created code that can hook system calls though both sysent and though jmp instructions on OS X 10.4.10 Intel. Im NOT asking you how to hook functions, please understand this. Regarding the linking against the entire kernel, do non-IOKit KEXTs link against the entire kernel by default and IOKit KEXTs do not, or is this another reason why my IOKit KEXT can not resolve execve? Regarding the whole kernel hook abuse issue. I think this could have a much better solution than security though obscurity. There are several articles in Phrack magazine on how to do this with previous versions of OS X and other similar OSes. I too figured out how to do this on current versions of OS X. There is also a primitive rootkit (WeaponX) in the wild that can hook system calls. So the cats out of the bag on os x kernel hooking. A better solution than saying it cant be done would be to offer a API that can do this and presents a warning to the user regarding the stability issues of doing so. When i was trying to figure out how to hook function calls i looked all over apple's dev lists and saw plenty of other people asking the same question, im sure you know this is a demand from developers to do this. Im sure if you spent some time on it you could think of a better idea than mine and one much better than saying it cant/ shouldnt be done. Thanks. On Aug 15, 2007, at 5:40 PM, Matt Burnett wrote: You didnt answer my question, and you jumped to conclusions. I all ready have functioning code to arbitrarily hook kernel functions. I didn't ask for help on how to do this, i just asked if there are any IOKit classes that implement features similar to mprotect/ vm_protect, I didn't answer because I'm not the best person to answer this particular question, and you are actually unlikely to find them on the "dev" list instead of the "kernel" list. Here is my best answer: "Unsupported" exports vm_protect, but to get the right map identifier you would have to go through other unsupported exports in order to find the right map for the task involved, and by the time you are down in the IOKit, if you are on a work loop or another thread, or the operation is an AIO operation being proxied on behalf of a user space process, or a request from an NFS client, etc., the task you get will not be the task that initiated the action. If so, you will not be able to make the call without information which is lost by the time the call to your code happens. This will also fail from 64 bit code, which requires the use of mach_vm_protect() instead of the 32 bit vm_protect() to represent address space ranges that span or which are above the 4G 32 bit address space limit. and why IOKit based KEXTs have issues resolving symbols in the kernel. Because we intentionally made it difficult to get at things we think will probably change over time, to try and ensure forwards binary compatibility for our KEXT developers and our users; when everything Just Works, that's best for everyone. You can't resolve many symbols because we __private_extern__'ed the sysent[] table members because people were hooking them (predominantly for antivirus software). These hooks don't work long term, and tend to break between software updates because these functions are not KPI; they are off limits for use in code you want to work after a software update, or between major releases. For example, we've changed the credential structure reference model several times in software updates in order to deal with a number of developer issues, so anything that attempts to deal with a cached reference to a cred (for example, creating a process via fork +execve) that used old code would suddenly be implemented incorrectly, if the code we intended was replaced by a third party with a copy from previously published versions of the code. You can always link your KEXT against the entire kernel, which gets you all the non-private symbols (private ones were stripped by the linker when Mach, BSD, and IOKit were linke to create mach_kernel), at the cost of your KEXT not working each time there is a software update. This will more or less ensure that you at least had opportunity to update to the most recent code base before you changed the version dependency string. - I can still use mprotect/vm_protect Please do so (see above); if someone else jumps in with a better answer, feel free to take their answer instead. - For the symbols issue, i can at the very worst use some script hackery to resolve the symbols in user space and transfer their addresses to my KEXT. I know there are tables in the kernel where i could resolve the symbols manually as well. Incorrect; these tables are all in user space after the message "Jettisoning kernel linker" is emitted to the console, very early in the boot process. All KEXT linking not coming out of preloading occurs in user space vs. the supported KPI symbol sets, and the symbol tables aren't mapped into kernel memory along with the rest of the KEXT or mach_kernel sections. I would like to remind you that hurling insults at me such as "unscrupulous" (definition: having or showing no moral principles; not honest or fair) does nothing other than provoke me to release a SDK to the public which would allow people to hook kernel functions. I was specifically referring to the act of overwriting kernel function entries, and the potential for misuse/abuse, and the high likelihood that the system would become unstable, if not immediately, then most probably as soon as you installed an update. FWIW, the already announced Leopard DTrace facility depends on being able to do this type of thing on its own, and would more or less stomp any code you put in its way. If you can't accomplish what you need to accomplish within the constraints of KPI, please contact DTS to request additional KPI. -- Terry This email sent to site_archiver(a)lists.apple.com

1 0