October 2009 - Darwin-dev - lists.apple.com

Re: Finding loaded kext binaries
by Andrew Myrick 16 Oct '09

16 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: single stepping into signals handlers
by Tristan Gingold 16 Oct '09

16 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 15, 2009, at 11:34 PM, Terry Lambert wrote: Hi, (not sure that this is the best list, feel free to redirect) Good idea. Thanks, Tristan. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 15, 2009, at 6:33 AM, Tristan Gingold wrote: currently Darwin clears RFLAGS.TF when a signal is delivered. As a consequence it is not possible to signal step through a signal handler. Is there a way to do this ? If not, could this behaviour be changed ? Signals are delivered by saving the old thread state structure, consing up a new one with the %eip/%rip pointing at the signal trampoline in user space, setting the actual saved thread state for user space in the thread state structure, and then resuming as if coming back from a trap handler. The only thing it has in common with the original thread is that it's temporarily borrowing its existance instead of cons'ing up a new thread. If you want to single step into a signal handler, place a breakpoint at the trampoline entry address, or if it's enough for you, at the handler addres, and single step from there. I assume from your email address that you're actually interested in this because you want to deal with exception unwinding in ADA. Treating signals as if they were the same things as exceptions is not likel to be a very fruitful exercise for you. If I'm mistaken, then perhaps you'd explain a little bit about what you're trying to do? Not related. I was trying to write a tool that stop a thread when it modifies a large variable. Anyway, I also have a question about exception unwinding and signal handlers. Our Ada compiler is able to detect stack overflow and to generate an exception in such case. This is in fact required by the Ada language and we do that on all our platforms. The good news with darwin is that the signal trampoline has unwind table for the trampolines. So we don't have to handle this particular case contrary to most others OSes. However for the stack checking feature, we use the alternate stack to handle SIGSEGV/SIGBUS. So far so good, but when the handler throw the exception, it doesn't reset the SS_ONSTACK flag. The only way to make this possible is to use the undocumented sigreturn API. Do you have any advices ? This email sent to site_archiver(a)lists.apple.com

1 0

Finding loaded kext binaries
by Rustam Muginov 16 Oct '09

16 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:from:to :content-type:content-transfer-encoding:mime-version:subject:date :x-mailer; bh=UvWTNqIxmXlglU8h5C8/i8KRerqf3k6F2ZB8sXt3GOI=; b=vaegeQM68Zj6i1vSyI3m6f/sC6JyMrocSCoGOIhThXNnOP76cVxSDsxaSHO0xNiPV2 Mh6K7YiSJ4K0KSmlG+FUShX1vdyO66oNkspII7L89cRefJ1sXj2fDS8ISFQJil/EHnHG rtMGybNRkDw+GU3OEYZc+CCHI/BDsEPP2sim4= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:from:to:content-type:content-transfer-encoding :mime-version:subject:date:x-mailer; b=O14dYh/Va1xVccgc7rfZvkl/DtEBIYUQmu0raU8wpPu3Mvlu6xaYVcqDVo9MzFQqPm 0KaNGqZKzQLQbI9GpM4VouWnAED08R+O3GDe3R3k+YI0QDdrbHxUejFW41cNFvNOblYg qJiEez7Z9Cw7feZL/MfHwlAHm5Tvq+wZdkCVg= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Hello all. Is it possible to locate the binary for an arbitrary kext, which may be outside of /System/Library/Extensions folder? kextfind utility, as far as I understand, performing folder iteration and need to scan all the disk if kext binary is not located at the standard place. -- Sincerely, Rustam Muginov This email sent to site_archiver(a)lists.apple.com

1 0

Re: single stepping into signals handlers
by Terry Lambert 15 Oct '09

15 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hi, (not sure that this is the best list, feel free to redirect) -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 15, 2009, at 6:33 AM, Tristan Gingold wrote: currently Darwin clears RFLAGS.TF when a signal is delivered. As a consequence it is not possible to signal step through a signal handler. Is there a way to do this ? If not, could this behaviour be changed ? Signals are delivered by saving the old thread state structure, consing up a new one with the %eip/%rip pointing at the signal trampoline in user space, setting the actual saved thread state for user space in the thread state structure, and then resuming as if coming back from a trap handler. The only thing it has in common with the original thread is that it's temporarily borrowing its existance instead of cons'ing up a new thread. If you want to single step into a signal handler, place a breakpoint at the trampoline entry address, or if it's enough for you, at the handler addres, and single step from there. I assume from your email address that you're actually interested in this because you want to deal with exception unwinding in ADA. Treating signals as if they were the same things as exceptions is not likel to be a very fruitful exercise for you. If I'm mistaken, then perhaps you'd explain a little bit about what you're trying to do? This email sent to site_archiver(a)lists.apple.com

1 0

single stepping into signals handlers
by Tristan Gingold 15 Oct '09

15 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hi, (not sure that this is the best list, feel free to redirect) Is there a way to do this ? If not, could this behaviour be changed ? Thanks, Tristan. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… currently Darwin clears RFLAGS.TF when a signal is delivered. As a consequence it is not possible to signal step through a signal handler. This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to manually register a symbol address in dyld?
by Stéphane Corthésy 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com OK, I hope my goal is clear now :-) Stéphane On Oct 14, 2009, at 4:40 PM, Peter O'Gorman wrote: Hello, On Oct 13, 2009, at 4:30 PM, Peter O'Gorman wrote: Hello, Peter -- Peter O'Gorman http://pogma.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Here's the real problem that I'm trying to fix in an "elegant" way (I can already fix it, but in a very inelegant way). ObjC 2.0 in 64 bits introduced the ability to not export the symbols of a class and metaclass: <http://developer.apple.com/mac/library/releasenotes/Cocoa/RN-ObjectiveC/ind… > I have a bundle for Mail, which uses the (quite private) Message framework; both Mail and Message framework used to export all their classes (which were easily to retrieve using class-dump), unfortunately it's no longer the case: everything in Mail and Message framework is private, no class/meta-class symbols are exported. This prevents me from subclassing a private class of Message framework nor writing a category on it, without writing some ugly code using class and method swizzling. The idea I have is to write a bundle A that wouldn't use any of the private classes, but would modify the dyld symbol tables and make these private classes no longer private by adding their symbols to dyld tables. Then my bundle A would load the bundle B which is weak- linked to Message framework, and add subclasses and categories to previously private classes. When bundle B is loaded, there are no more private classes, because bundle A registered all the '_OBJC_CLASS_ $_ClassName' and '_OBJC_METACLASS_$_ClassName' needed symbols to dyld tables (it's easy to do introspection in ObjC runtime and get the addresses of the classes and metaclasses). This way of doing things would allow me to still subclass and write categories on private Message classes without having to modify my code and doing class and method swizzlings. On 10/14/2009 08:56 AM, Stéphane Corthésy wrote: On 10/13/2009 02:55 AM, Stéphane Corthésy wrote: For some reason (that I'll explain later), I need to load a bundle which contains symbols undefined in application libraries. BUT, though these symbols are undefined, the actual implementations are present in current runtime, but under a different symbol. Thus, before loading that bundle I need to manually tell dyld that symbol 'my_renamed_function' should be bound to 'my_original_function' already present in system libraries. Or I need a hook that would allow me to do that while loading the bundle. I'm working on 10.6. I tried to look at dyld source code, but got lost :-) I tried to use NSInstallLinkEditErrorHandlers, but my handler wasn't invoked. So, is there a way to do that, and how? Why do you need to do this? There are very likely alternative ways of doing what you need e.g. weak undefined external symbols, That cannot work. As I wrote, the bundle (already weakly linked) has symbols that are not available on 10.6 (they were on 10.5), BUT though the symbols are not exported, the actual functions are available in 10.6, thus I'd like to create a bundle which would augment dyld symbol table and then load the other bundle with (previously unknown) symbols, and it would link well. I am still unsure what you're trying to fix. If I am reading this right, the bundle is using OS symbols that were global and exported in 10.5, but have become local symbols in 10.6, and you want it to keep using them (because you're using a third party plugin and you don't have access to the source code?). You could certainly load a library on 10.6 (or use DYLD_INSERT_LIBRARIES) that provides functions with the names your plugin uses, goes through the symbol tables looking for the address of the local-on-10.6 symbols, and calls them. How to do that is documented in the header files in /usr/include/mach-o and on developer.apple.com. However, if you have access to the source code for the bundle, then I suggest fixing it so that it does not require private symbols. This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to manually register a symbol address in dyld?
by Terry Lambert 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com -- Terry Hello, Hello, I don't know what it is. I saw no mention on 'alias' in dyld code. Wouldn't work, like with weak symbols. I will, once I know how to do it ;-) Thanks, _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… So set the SDK and deployment target to the earlier version, problem solved. The symbols are deprecated on newer versons of the OS because it is intended that you eventually stop using them so that they can be removed entirely in subsequent versions of the OS. Otherwise libraries would be like sedimentary rock, slowly accumulationg layers over the ages, until one day you realize you have vast tracts of uninhabitable land. Sure, the Painted Desert, Goblin Valley, Arches National Park, Zion National Park, and the Grand Canyon are nice to visit, but you likely don't want those strange rock formations, mountains, deep gullies, and abandoned cliff dwellings living in your limited address space, in all your applications, forever. On Oct 14, 2009, at 6:56 AM, Stéphane Corthésy <stephane(a)sente.ch> wrote: On Oct 13, 2009, at 4:30 PM, Peter O'Gorman wrote: On 10/13/2009 02:55 AM, Stéphane Corthésy wrote: For some reason (that I'll explain later), I need to load a bundle which contains symbols undefined in application libraries. BUT, though these symbols are undefined, the actual implementations are present in current runtime, but under a different symbol. Thus, before loading that bundle I need to manually tell dyld that symbol 'my_renamed_function' should be bound to 'my_original_function' already present in system libraries. Or I need a hook that would allow me to do that while loading the bundle. I'm working on 10.6. I tried to look at dyld source code, but got lost :-) I tried to use NSInstallLinkEditErrorHandlers, but my handler wasn't invoked. So, is there a way to do that, and how? Why do you need to do this? There are very likely alternative ways of doing what you need e.g. weak undefined external symbols, That cannot work. As I wrote, the bundle (already weakly linked) has symbols that are not available on 10.6 (they were on 10.5), BUT though the symbols are not exported, the actual functions are available in 10.6, thus I'd like to create a bundle which would augment dyld symbol table and then load the other bundle with (previously unknown) symbols, and it would link well. symbol aliases, using dlsym() to check at runtime what symbols are available etc etc. Please provide more details about the problem you're trying to solve. Stéphane This email sent to site_archiver(a)lists.apple.com

1 0

Re: kqueue EVFILT_PROC and child process pid
by Ryan McGann 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 14, 2009, at 6:20 AM, Terry Lambert wrote: On Oct 12, 2009, at 12:45 PM, Rustam Muginov wrote: Thank you a lot for pointing up to the audit method. I had found the "bsm" folder in the Mac OS X 10.5 SDK, looked through the header files, but failed to find and documentation on them so far. rdar://problem/7244262 Summary: When a KAUTH_SCOPE_FILEOP listener receives a KAUTH_FILEOP_EXEC notification, there is no indication as to which process has loaded the indicated executable. Calling proc_self() or proc_selfpid() sometimes returns the loading process and sometimes returns the parent of the process. (Unsure if there are any cases in which it returns neither.) Suggested enhancement: When exec_activate_image() calls kauth_authorize_fileop() to broadcast the KAUTH_FILEOP_EXEC notification, it passes zero as the unused final argument to kauth_authorize_fileop(). At that point, it also has information from which the desired BSD process could be derived, so it could pass the proc_t pointer or the pid value for the process as that final argument. Ryan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 13, 2009, at 9:40 PM, Ryan McGann <rmcgann(a)mac.com> wrote: On Oct 13, 2009, at 12:08 PM, darwin-dev-request(a)lists.apple.com wrote: P.S. I should have mentioned that /dev/auditpipe is not available on 10.5 but currently only 10.6. Also, 10.5 doesn't have audit events available for system calls like posix_spawn(). It seems that posix_spawn() is used a lot by Mac OS X. This is tagential, but still related, to another bug that we have found, and already reported. It was present in 10.5 but not many people used posix_spawn, but Apple uses it a lot more internally in 10.6. We tried to work around it, but it's proven more difficult than originally thought. Basically, we track all fileop_exec notifications to internally watch processes being launched, but when posix_spawn is used, the code path is slightly different (see xnu). For posix_spawn, the fileop_exec notification is "posted" inside the context of the parent process, not the child, making it impossible to tell what is the new process ID. Not the same as the original problem stated here, but if the OP wants to use a kernel extension, be warned that kauth_fileop_exec won't work correctly in Snow Leopard either. It works correctly, just not in the way you'd want it to work if your intent was to inject code into each newly created process before it got up and running. I am personally not a big fan of code injection of this type, as it is inexact with regard to scheduling, at best. Better that you use the spawn extensions yourself to start the child in a suspended state with access to its task port directly. We're not trying to inject, just trying to monitor. In fact, we don't really need the notification at all, except for the fact that the KPIs have no way to obtain a vnode or path pointer from a pid_t. The kauth_fileop_exec was added at our request during an Apple KPI kitchen as a workaround for the lack of a pid_t -> vnode mapping. We need that mapping for a variety of reasons that Apple acknowledged were desired by both us and other 3rd parties, as well as some within Apple itself. But the kernel still lacks it, so we have a very complex IOKit kernel extension that just sits there, watching for fileop_open, fileop_close and fileop_exec notifications so we can try and maintain the mapping ourself (has to be IOKit so it can set the OSBundleRequired == Root flag in its Info.plist). It's a huge kludge, and one we want to avoid, but until rdar://problem/ 3751262 is addressed, it's the only choice we have. The kludge gets even bigger with Snow Leopard, so that we can address posix_spawn, which is where this issue came up. Since we have to do the pid lookup in-kernel, the auditing facilities and kqueue are not a viable option for us. This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to manually register a symbol address in dyld?
by Amanda Walker 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Here are some examples of how to use it: http://tlrobinson.net/blog/2007/12/21/overriding-library-functions-in-mac-o… --Amanda _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Oct 14, 2009, at 9:56 AM, Stéphane Corthésy wrote: That cannot work. As I wrote, the bundle (already weakly linked) has symbols that are not available on 10.6 (they were on 10.5), BUT though the symbols are not exported, the actual functions are available in 10.6, thus I'd like to create a bundle which would augment dyld symbol table and then load the other bundle with (previously unknown) symbols, and it would link well. You might be able to do this with DYLD_INSERT_LIBRARIES, though without knowing exactly how your application is structured it's a little difficult to tell. This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to manually register a symbol address in dyld?
by Peter O'Gorman 14 Oct '09

14 Oct '09

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.4pre) Gecko/20090922 Fedora/3.0-2.7.b4.fc11 Thunderbird/3.0b4 Hello, On Oct 13, 2009, at 4:30 PM, Peter O'Gorman wrote: Hello, For some reason (that I'll explain later), I need to load a bundle which contains symbols undefined in application libraries. BUT, though these symbols are undefined, the actual implementations are present in current runtime, but under a different symbol. Thus, before loading that bundle I need to manually tell dyld that symbol 'my_renamed_function' should be bound to 'my_original_function' already present in system libraries. Or I need a hook that would allow me to do that while loading the bundle. I'm working on 10.6. I tried to look at dyld source code, but got lost :-) I tried to use NSInstallLinkEditErrorHandlers, but my handler wasn't invoked. Why do you need to do this? There are very likely alternative ways of doing what you need e.g. That cannot work. As I wrote, the bundle (already weakly linked) has symbols that are not available on 10.6 (they were on 10.5), BUT though the symbols are not exported, the actual functions are available in 10.6, thus I'd like to create a bundle which would augment dyld symbol table and then load the other bundle with (previously unknown) symbols, and it would link well. Peter -- Peter O'Gorman http://pogma.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 10/14/2009 08:56 AM, Stéphane Corthésy wrote: On 10/13/2009 02:55 AM, Stéphane Corthésy wrote: So, is there a way to do that, and how? weak undefined external symbols, I am still unsure what you're trying to fix. If I am reading this right, the bundle is using OS symbols that were global and exported in 10.5, but have become local symbols in 10.6, and you want it to keep using them (because you're using a third party plugin and you don't have access to the source code?). You could certainly load a library on 10.6 (or use DYLD_INSERT_LIBRARIES) that provides functions with the names your plugin uses, goes through the symbol tables looking for the address of the local-on-10.6 symbols, and calls them. How to do that is documented in the header files in /usr/include/mach-o and on developer.apple.com. However, if you have access to the source code for the bundle, then I suggest fixing it so that it does not require private symbols. This email sent to site_archiver(a)lists.apple.com

1 0