February 2010 - Darwin-dev - lists.apple.com

Re: How to get current process executable from KEXT?
by Jakub Bednar 02 Feb '10

02 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

trying to build dtrace on 10.6.2
by jane phanie 02 Feb '10

02 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=M1slnBPBGcBVN6msrTmTxF7TirayjqoM3OFvOgWceEg=; b=o1IrxjLwCUSmmfJHs32nRvkd8H5FR634UQBbOMwftwBCtoTZs+0cmFbOT1VBt/0NqZ rNSe8DtNS8m1yvgJ9mqBAn3Zi/KmZrkDzmwPljZjWkj6AYYtinXIuEkrBfohZG9UwS4V 09Wh1bgrUIv12OKJFIMLZ+EZnxWkIa30ixtqc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=HjyGKBoakyh4CIBqZNjq7eNgg2iS7m0E0+qD31Gqgvg22YY6X9RFveFbh+koEXDMLt 9gNfUnMAgQIPxlIDgshnpjNPXmf70oBaymyPEe1nIGRQb2xajsxsyBAZO5RqQ0iFBUxI zLQa2HFX4Xj2s7Ds0eQxw+5eZzg1kNOVeFHC4= Hi, Searched the archives and web, but I haven't seen any info on this... I'm trying to build the dtrace target in the Xcode project using the advice here: http://osx86.boeaja.info/2009/10/building-xnu-kernel-on-snow-leopard/ But I get: libproc.m:24:49: error: CoreSymbolication/CoreSymbolication.h: No such file or directory I realize CoreSymbolication is a private framework, but Apple must make this header available somewhere in order for me to build dtrace, right? Can someone point me to the necessary files to build dtrace? Thx, Jane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get current process executable from KEXT?
by Brian Mastenbrook 01 Feb '10

01 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.7) Gecko/20100111 Thunderbird/3.0.1 Well yes, but the malware would need super-user permissions to do that. If your system is compromised, then there is nothing anyone can do. On the other hand, if you can't check the full path, than anyone (even a regular user) can create a binary with the name "utility" anywhere in the system and will be confused with the /usr/bin/utility in let's say "trusted and protected" path. -- Brian Mastenbrook brian(a)mastenbrook.net http://brian.mastenbrook.net/ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 2/1/2010 6:24 AM, Jakub Bednar wrote: The best would be to do a code signature check, but I haven't found any kernel API to do this. I'm not quite sure what you're trying to accomplish, but I'm pretty sure that you're doing it wrong. Checking that the process being invoked is /usr/bin/utility instead of /Users/ben/utility won't help if the action you're scanning for can be carried out by /usr/bin/utility - either intentionally or due to a flaw in how the utility is written. And there are numerous methods that can be used from an ordinary user account to cause a process running as that user to execute arbitrary code. If executable path-based protection is central to your anti-malware product, your product won't be much of a problem for malware authors at all. This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get current process executable from KEXT?
by Jakub Bednar 01 Feb '10

01 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Well yes, but the malware would need super-user permissions to do that. If your system is compromised, then there is nothing anyone can do. On the other hand, if you can't check the full path, than anyone (even a regular user) can create a binary with the name "utility" anywhere in the system and will be confused with the /usr/bin/utility in let's say "trusted and protected" path. The best would be to do a code signature check, but I haven't found any kernel API to do this. Jakub On Feb 1, 2010, at 12:58 PM, Shantonu Sen wrote: > Why does the full path help you? What additional verification are you planning on doing? If the malware does system("/bin/mv /malware/utility /usr/bin/utility") and re-execs itself, how will you detect that case? > > Shantonu > > Sent from my MacBook > > On Feb 1, 2010, at 3:03 AM, Jakub Bednar wrote: > >> Hi list, >> >> can please anyone help me to figure out how to get the executable path for current process from within a KEXT? >> >> The Mac OS X Internals book points to p_textvp field of struct proc, but this is not a public API. I have also found a post that says that this field is not even set by exec system calls. >> >> I have tried the proc_selfname(), but this is returning only the name, without the full path. It is returning the p_comm[] field of struct proc internally. >> >> I have checked how the user-space lsof utility does its job, and it uses the proc_pidbsdinfo() call. This call returns the p_name[] field of struct proc as the name of the executable with full path. However the proc_pidbsdinfo() is not in the Kernel.framework headers so it probably can't be used in a KEXT. >> >> Can anyone help me to solve this? I really need to distinguish between e.g. /usr/bin/utility and /malware/utility. >> >> Thanks a lot, >> >> Jakub >> >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> http://lists.apple.com/mailman/options/darwin-dev/ssen%40apple.com >> >> This email sent to ssen(a)apple.com > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get current process executable from KEXT?
by Shantonu Sen 01 Feb '10

01 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Why does the full path help you? What additional verification are you planning on doing? If the malware does system("/bin/mv /malware/utility /usr/bin/utility") and re-execs itself, how will you detect that case? Shantonu Sent from my MacBook On Feb 1, 2010, at 3:03 AM, Jakub Bednar wrote: > Hi list, > > can please anyone help me to figure out how to get the executable path for current process from within a KEXT? > > The Mac OS X Internals book points to p_textvp field of struct proc, but this is not a public API. I have also found a post that says that this field is not even set by exec system calls. > > I have tried the proc_selfname(), but this is returning only the name, without the full path. It is returning the p_comm[] field of struct proc internally. > > I have checked how the user-space lsof utility does its job, and it uses the proc_pidbsdinfo() call. This call returns the p_name[] field of struct proc as the name of the executable with full path. However the proc_pidbsdinfo() is not in the Kernel.framework headers so it probably can't be used in a KEXT. > > Can anyone help me to solve this? I really need to distinguish between e.g. /usr/bin/utility and /malware/utility. > > Thanks a lot, > > Jakub > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-dev/ssen%40apple.com > > This email sent to ssen(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

How to get current process executable from KEXT?
by Jakub Bednar 01 Feb '10

01 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hi list, can please anyone help me to figure out how to get the executable path for current process from within a KEXT? The Mac OS X Internals book points to p_textvp field of struct proc, but this is not a public API. I have also found a post that says that this field is not even set by exec system calls. I have tried the proc_selfname(), but this is returning only the name, without the full path. It is returning the p_comm[] field of struct proc internally. I have checked how the user-space lsof utility does its job, and it uses the proc_pidbsdinfo() call. This call returns the p_name[] field of struct proc as the name of the executable with full path. However the proc_pidbsdinfo() is not in the Kernel.framework headers so it probably can't be used in a KEXT. Can anyone help me to solve this? I really need to distinguish between e.g. /usr/bin/utility and /malware/utility. Thanks a lot, Jakub _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

AAC+ files support in itunes?
by Arnab Ganguly 01 Feb '10

01 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=aqb05Lw5S9NNlh8kQ+4IFXSeTS98RBHf1E6eXTrerV0=; b=XNs6WX0pd50D6CCYhgfmDna0U9LzV3+oBaVU8HSN5VK8fJpaq6CUGRSGN645vFenUy VMI+gdUZaa8XemC5aFwNq/Sr6J7ze+F/jKbXfnQAPTW4k+0J4dIJUuDGVtwsW/lJ54LD s8alzCd3F1xmSam0bePXYpe3Sehf/74LkUpXk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=xcQHtuW/NTNtaIi3KM2w6mAuCM8Z47abvXiOtoh8LVVT2nOCa1r1skCGkdzAzCmKxc rWbDS0oXr3BHPbO8Z9HsNq1LPHdlpKSJHkjn4VbgwDEBeOM0cpp+KfM/1eD2S5Yo3HH8 ZrjSSAt0GQFEOX4UO+N2Us8Du7/QgaMYaS2ms= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0