August 2007 - Darwin-dev - lists.apple.com

Re: IOKit KEXT Questions
by Terry Lambert 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com No, there are not. Your best bet is to deal with this from user space instead. Expect that this could break in software updates. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 15, 2007, at 5:40 PM, Matt Burnett wrote: You didnt answer my question, and you jumped to conclusions. I all ready have functioning code to arbitrarily hook kernel functions. I didn't ask for help on how to do this, i just asked if there are any IOKit classes that implement features similar to mprotect/vm_protect, I didn't answer because I'm not the best person to answer this particular question, and you are actually unlikely to find them on the "dev" list instead of the "kernel" list. Here is my best answer: "Unsupported" exports vm_protect, but to get the right map identifier you would have to go through other unsupported exports in order to find the right map for the task involved, and by the time you are down in the IOKit, if you are on a work loop or another thread, or the operation is an AIO operation being proxied on behalf of a user space process, or a request from an NFS client, etc., the task you get will not be the task that initiated the action. If so, you will not be able to make the call without information which is lost by the time the call to your code happens. This will also fail from 64 bit code, which requires the use of mach_vm_protect() instead of the 32 bit vm_protect() to represent address space ranges that span or which are above the 4G 32 bit address space limit. and why IOKit based KEXTs have issues resolving symbols in the kernel. Because we intentionally made it difficult to get at things we think will probably change over time, to try and ensure forwards binary compatibility for our KEXT developers and our users; when everything Just Works, that's best for everyone. You can't resolve many symbols because we __private_extern__'ed the sysent[] table members because people were hooking them (predominantly for antivirus software). These hooks don't work long term, and tend to break between software updates because these functions are not KPI; they are off limits for use in code you want to work after a software update, or between major releases. For example, we've changed the credential structure reference model several times in software updates in order to deal with a number of developer issues, so anything that attempts to deal with a cached reference to a cred (for example, creating a process via fork+execve) that used old code would suddenly be implemented incorrectly, if the code we intended was replaced by a third party with a copy from previously published versions of the code. You can always link your KEXT against the entire kernel, which gets you all the non-private symbols (private ones were stripped by the linker when Mach, BSD, and IOKit were linke to create mach_kernel), at the cost of your KEXT not working each time there is a software update. This will more or less ensure that you at least had opportunity to update to the most recent code base before you changed the version dependency string. - I can still use mprotect/vm_protect Please do so (see above); if someone else jumps in with a better answer, feel free to take their answer instead. - For the symbols issue, i can at the very worst use some script hackery to resolve the symbols in user space and transfer their addresses to my KEXT. I know there are tables in the kernel where i could resolve the symbols manually as well. Incorrect; these tables are all in user space after the message "Jettisoning kernel linker" is emitted to the console, very early in the boot process. All KEXT linking not coming out of preloading occurs in user space vs. the supported KPI symbol sets, and the symbol tables aren't mapped into kernel memory along with the rest of the KEXT or mach_kernel sections. I would like to remind you that hurling insults at me such as "unscrupulous" (definition: having or showing no moral principles; not honest or fair) does nothing other than provoke me to release a SDK to the public which would allow people to hook kernel functions. I was specifically referring to the act of overwriting kernel function entries, and the potential for misuse/abuse, and the high likelihood that the system would become unstable, if not immediately, then most probably as soon as you installed an update. FWIW, the already announced Leopard DTrace facility depends on being able to do this type of thing on its own, and would more or less stomp any code you put in its way. If you can't accomplish what you need to accomplish within the constraints of KPI, please contact DTS to request additional KPI. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Rereading A Partition Table
by Duane Murphy 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com --- At Wed, 15 Aug 2007 17:26:42 -0700, Chris Sarcone wrote: >Duane -- > >I'm making changes to GUID partition disks partition table, and I would >like the system to re-read the disk in order to recognize new partitions >on the disk. > >What do I need to do to get the system to re-read the disk and recognize >the changes? > >I've tried several disk util commands (unmountDisk, mountDisk, and >eject) but they don't re-read the disk. > >Disk Utility->Eject does the same thing (ie nothing). > >I note that this is a FireWire drive, but it could also be an internal >drive or any other non-network drive. > >For example, when Disk Utility partitions a disk, it fully unmounts and >then remounts the disk. How can I do the same thing? > >Try opening and closing the raw disk node for the whole device. > Hi Chris, That's what I was told. In fact, I am editing the partition table using / dev/rdisk1 (or whatever number). But when it is closed it doesn't do anything. Here's how I open. inDisk is "/dev/rdisk1" (for example); int diskDescriptor = open( inDisk, O_RDWR | O_SHLOCK, S_IRUSR | S_IWUSR | S_IRGRP ); later I just close( diskDescriptor ); There's no errors and in fact, the disk is nicely edited. If I unplug the drive and plug it back in the partitions looks exactly like what I want, but it's hard to do that for internal disks. :-) ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Disk Arbitration: Preventing the disk insertion (unrecognized volume) dialog
by Ron Aldrich 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Folks, I register a disk appeared callback to the Disk Arbitration framework. This is where things go bad. The driver creates an IOMedia object for the freshly formatted disk. My disk appeared callback gets called. So, how should I be intercepting that dialog? Thanks for your time, Ron Aldrich Software Architects, Inc. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I'm working on a disk formatting utility to support some specialized media and file system types, and I'm running into a bit of a problem with Disk Arbitration. I don't seem to be able to prevent the disk insertion (unrecognized volume) dialog from appearing after I issue a low-level format call to the device. Currently, I use diskutil to unmount the disk (if it was mounted - it's possible that there is unformatted media in the drive, and therefore no IOMedia object). I then ask the driver to format the media - if it had an IOMedia object, it tears it down, and formats the disk, and re-enables polling. In the disk appeared callback, I call DADiskClaim, in an attempt to prevent the unrecognized volume dialog from appearing. Apparently it's too late at this point. My diskClaimed callback gets called, the disk gets partitioned, and everything proceeds normally, except that there is an unwanted dialog on the screen. This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Shawn Erickson 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=FWuY/zrfWMYc+R2Hwo7Jgz55Xfics+rVSTHqfjfbICR8lWyGIwLnssDDu/KWbVM80zQS+S4Uk3mHQ93Muati2+b4l5WUZOiuwkmgO/l03OCkOS95LqdBkJdCOPVVx+ySKwFI89l9wltVQiUlrfLIuHYdNHcuLoQj3ZoOQ/9DKAc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=b8ouxCJI2Z5+dajirYhXS1nTRz5aBx03FHTkk6KrZQttVDtvpSv8qzvLMkG7sWIi6icDzoDyjczrG65mvv0t9G/WgTNFCakSBNVzR8/XLwYuz/xLWMDMxm0Aenr/m9PqbF1pLiCQ+M1jaTmKmIhbaFpmpntlC8iC+maVrxutKN8= On 8/15/07, Matt Burnett <matt.w.burnett(a)gmail.com> wrote: > Not answering these questions wont prevent me from > accomplishing my task. Can you better explain what your task is? Helps to have context when attempting to answer questions. > - I can still use mprotect/vm_protect > - For the symbols issue, i can at the very worst use some script > hackery to resolve the symbols in user space and transfer their > addresses to my KEXT. I know there are tables in the kernel where i > could resolve the symbols manually as well. Hooking kernel functions should not be done. Apple does not provide any binary, etc. compatibility at that level in Mac OS X. As Terry was stating software updates (including security updates, etc.) could change things around on you and cause things to break. > I would like to remind you that hurling insults at me such as > "unscrupulous" (definition: having or showing no moral principles; > not honest or fair) does nothing other than provoke me to release a > SDK to the public which would allow people to hook kernel functions. wow, think you took things the wrong way... -Shawn _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Matt Burnett 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=Vq6NnFHaq6ANoAvK8GbXf6q5o2g4RywyjYihCiqWEGrLWJW5QBOeXbaEMpugTLKIi/h9RXgFuWBe9xFx5Ioth/CYztFjkQtjja/YSLfMteNXvwtgEUnwUwsDn15CDGRP+Qni3egU79QBsdxuNVdMcoLJ5Y0ZZwN+JTXghmY/adM= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer; b=WXAJImsi5Qb7ATZVJvjBOKM9LlTTUyYgY1qu9GdTwbyvyBoCY6StyirD4ro1gLOVoDU2bb0ODdK7P46M5YE3o3jHmSXfdG7SY9v1xOnJZu4fxzIYpPbZ3lm4udArTvPfQeeHW7G8GCPM+ZC5hI4BcScI4QtzBr9zTszdkXhmEVk= On Aug 15, 2007, at 6:24 PM, Terry Lambert wrote: I have 2 questions regarding IOKit KEXTs. Example HelloIOKit.cpp Code: ... extern "C" int execve(void *, void *, int *); ... IOLog("Found execve at %p\n",execve); ... Example kextload output: kextload: extension HelloIOKit.kext appears to be valid kld(): Undefined symbols: _execve ... _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… You didnt answer my question, and you jumped to conclusions. I all ready have functioning code to arbitrarily hook kernel functions. I didn't ask for help on how to do this, i just asked if there are any IOKit classes that implement features similar to mprotect/vm_protect, and why IOKit based KEXTs have issues resolving symbols in the kernel. Not answering these questions wont prevent me from accomplishing my task. - I can still use mprotect/vm_protect - For the symbols issue, i can at the very worst use some script hackery to resolve the symbols in user space and transfer their addresses to my KEXT. I know there are tables in the kernel where i could resolve the symbols manually as well. I would like to remind you that hurling insults at me such as "unscrupulous" (definition: having or showing no moral principles; not honest or fair) does nothing other than provoke me to release a SDK to the public which would allow people to hook kernel functions. On Aug 15, 2007, at 3:21 PM, Matt Burnett wrote: - How does IOMemoryDescriptor deal with memory protection (mprotect/vm_protect)? Is there a class available to check/change the protection of certain pages in memory or should i use mprotect/ vm_protect? - Why do IOKit KEXTs have issues resolving kernel symbols, and what can i do to work around it. For example if i create a KEXT in C, i can lookup the address of any symbol which is in /mach.sym, however I get unresolved symbol errors if i do the same in a IOKit KEXT. We hide system calls so someone unscrupulous does not overwrite their entry points with jump instructions to their own code, perhaps thinking that we do not change locking or other implementations details in software updates. If you need to trap and/or prevent this type of operation for legitimate reasons, use kauth instead. -- Terry This email sent to site_archiver(a)lists.apple.com

1 0

Re: Rereading A Partition Table
by Chris Sarcone 16 Aug '07

16 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Questions
by Terry Lambert 15 Aug '07

15 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com I have 2 questions regarding IOKit KEXTs. Example HelloIOKit.cpp Code: ... extern "C" int execve(void *, void *, int *); ... IOLog("Found execve at %p\n",execve); ... Example kextload output: kextload: extension HelloIOKit.kext appears to be valid kld(): Undefined symbols: _execve ... -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Aug 15, 2007, at 3:21 PM, Matt Burnett wrote: - How does IOMemoryDescriptor deal with memory protection (mprotect/ vm_protect)? Is there a class available to check/change the protection of certain pages in memory or should i use mprotect/ vm_protect? - Why do IOKit KEXTs have issues resolving kernel symbols, and what can i do to work around it. For example if i create a KEXT in C, i can lookup the address of any symbol which is in /mach.sym, however I get unresolved symbol errors if i do the same in a IOKit KEXT. We hide system calls so someone unscrupulous does not overwrite their entry points with jump instructions to their own code, perhaps thinking that we do not change locking or other implementations details in software updates. If you need to trap and/or prevent this type of operation for legitimate reasons, use kauth instead. This email sent to site_archiver(a)lists.apple.com

1 0

Rereading A Partition Table
by Duane Murphy 15 Aug '07

15 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com I'm making changes to GUID partition disks partition table, and I would like the system to re-read the disk in order to recognize new partitions on the disk. What do I need to do to get the system to re-read the disk and recognize the changes? I've tried several disk util commands (unmountDisk, mountDisk, and eject) but they don't re-read the disk. Disk Utility->Eject does the same thing (ie nothing). I note that this is a FireWire drive, but it could also be an internal drive or any other non-network drive. For example, when Disk Utility partitions a disk, it fully unmounts and then remounts the disk. How can I do the same thing? Thanks, ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

IOKit KEXT Questions
by Matt Burnett 15 Aug '07

15 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:mime-version:to:message-id:content-type:from:subject:date:x-mailer; b=UDlfPdYMt9ZulJLQYOKeV7ZxmAn4Nal8QSr2/G1W0fi4MKtCWEQP5D6cu9uy7ERGn5zbfytzkZ9tvZ6iVxQSbIvwPLzx9zR6yp3+UVv9QblKAoJP2GJao1fh5GPsXNnBCv7lIy1GWHOb034aBgVPhx42jjOWNVVJ/W4IWb9yMiQ= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:mime-version:to:message-id:content-type:from:subject:date:x-mailer; b=R8/S18R5Qr0nhCli39b83k3Zkcom/o9hsmVwQEAOzU8yItxmqvk/lcbymcOxz7xGzGwk9xEcvPqwBjL7ZuXYWzMAzeHWvNoKJdo7hWD1L4bckAwTC/HsVACL/jUCY37LEBjWCf0+Lp1Ywo6e60IVtO/NUjrNOOCBjoRRK47gxFk= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

[GDB] template bug
by Jens Frederich 09 Aug '07

09 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type; b=DAMbUFFdLxBc1IZKlbVTlkJMvtWaJjb+4+IhTUBJoqXgLLOTXvsJIeM2Do+/b6hQVMnohOhxiPqnz6jYt2fCCm+RriUvAA9QQjfLwUrljoCN6b7DJjsyHU9UteZ8VVIsVhKLu3TVGXn1R3XD9SdOxns1mVZw+6knf6au3y0mo8c= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type; b=iNEtJqm6Lta28g76vXMLk675vsNeYocGG8rNlIYK2A5OXA/sJuenpBEm631phe+neggK96NWMP70qGmbPjzbI5B69phEMytUeEEiX67LlGZnQdC4z8H1IgLlPaN9UrJocTyIlWpSvL92OJcbtyJkmxu0jwYZm06SD1igXE43o3g= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0