October 2013 - Darwin-dev - lists.apple.com

In-Kernel mach message receiving...
by Mario Ströhlein 07 Oct '13

07 Oct '13

Hello list, I'm having trouble at really getting the difference between a mach_port_t (aka ipc_port_t) and mach_port_name_t. What I want to achieve is to allocate a mach port with receive rights and receive its messages. What I tried so far. ipc_port_alloc() which gives me a mach_port_t and a mach_port_name_t. With ipc_space_kernel it panic()s immediately. So I have used a task_t and use get_task_ipcspace() and it's okay. As far as looking at XNU sources it leaves the port in a locked state. Which is bad. So I tried the slightly higher level mach_port_allocate() which just gives me a mach_port_name_t back. To get a mach_port_t from it I tried ipc_object_copying() which succeeds and I get the desired mach_port_t back, I think, it is almost a valid pointer. But after that I want to send this port back to the User-Space task with mach_msg_send_from_kernel() which panic()s. LLDB backtrace tells me that something regarding locking is not okay. I also experimented with ipc_port_alloc_special() and a few other calls. ipc_port_make_send(), ipc_object_copyin_from_kernel, and and and... But even when I manage to send an allocated port (in the tasks ipc space) back to the User-Space task from kernel, which I already managed at somepoint, but don't know anymore how exactly I managed that due to too many experimenting and trial and error. Also the use of CAST_MACH_PORT_TO_NAME() and CAST_MACH_NAME_TO_PORT() are totally unclear to me. After successfull delivery of the port I spawn a new kernel thread upon which I want to receive messages. Tried with mach_msg_receive() and mach_msg_overwrite() I end up with a return code of MACH_RCV_INVALID_NAME. So my question is, how to allocate a mach_port_t (aka ipc_port_t) with receive rights and receive messages on it. At it's best in ipc_space_kernel or ipc_space_reply so I must not rely on a user-space task. Many thanks in advance. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlsym interposition question
by Stephen Checkoway 07 Oct '13

07 Oct '13

On Oct 6, 2013, at 6:29 PM, Ariel Burton <ariel.burton(a)roguewave.com> wrote: > This also doesn't quite do what I'm after. > > How are you loading libfoo.dylib? Are you linking it with your > main program? Are you loading it with dlopen? Or are you > perlaoding it with DYLD_INSERT_LIBRARIES? Sorry, I didn't pay close enough attention to your actual question. Looking through the source for dyld, it isn't obvious how to avoid the interposed symbols: >From <http://www.opensource.apple.com/source/dyld/dyld-210.2.3/src/dyldAPIs.cpp> and <http://www.opensource.apple.com/source/dyld/dyld-210.2.3/src/ImageLoaderMac…>, dlsym() calls ImageLoaderMachO::getExportedSymbolAddress() which calls ImageLoaderMachO::getSymbolAddress() which checks the list of interposed symbols. Similarly, the deprecated NSAddressOfSymbol() uses ImageLoaderMachO::getExportedSymbolAddress(). You could use the functions and data structures in mach-o/*.h to parse the various images and get the interposed symbol addresses, I suppose. -- Stephen Checkoway _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlsym interposition question
by Ariel Burton 06 Oct '13

06 Oct '13

This also doesn't quite do what I'm after. How are you loading libfoo.dylib? Are you linking it with your main program? Are you loading it with dlopen? Or are you perlaoding it with DYLD_INSERT_LIBRARIES? I played with your formula for the case where I load the library with DYLD_INSERT_LIBRARIES. I found that the key RTLD flag that made a difference was RTLD_FIRST. When I gave this in the main program, dlsym did not find my interposing definition for getpid. Perhaps to be clearer, how, when one is interposing a symbol, can a main program find both the interposing definition and also the definition that is being interposed? Ariel Burton == On Sun 6 Oct 15:50, Stephen Checkoway wrote: > > On Oct 6, 2013, at 4:33 PM, Ariel Burton <ariel.burton(a)roguewave.com> wrote: > > > Firstly, I'm not sure I made this clear. What I want to do > > is to be able to locate the interposing implementation of > > getpid and the underlying system-provided implementation > > in the main program. > > > > On ELF-like systems dlopening the dynamic library explicitly > > allows the definition in that library to be found. That's > > not happening here. > > > You can do that on Darwin too using RTLD_NOLOAD: > > void lookup_symbol(const char *name) > { > unsigned images = _dyld_image_count(); > int num = 0; > > for (unsigned i = 0; i < images; ++i) > { > const char *path = _dyld_get_image_name(i); > void *handle = dlopen(path, RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD | RTLD_FIRST); > void *sym = dlsym(handle, name); > if (sym) > printf("%d: %u %s %p\n", num++, i, path, sym); > dlclose(handle); > } > } > > With this in both a library containing a getpid() (libfoo.dyld) and in the main executable linking to the library, calling lookup_symbol("getpid") prints: > > 0: 1 /private/tmp/libfoo.dyld 0x102896cf0 > 1: 2 /usr/lib/libSystem.B.dylib 0x7fff8edecc2c > 2: 19 /usr/lib/system/libsystem_kernel.dylib 0x7fff8edecc2c > > Likewise, from both libfoo.dyld, printing the address of getpid gives > getpid from main: 0x102896cf0 > getpid from library: 0x102896cf0 > > Hope that helps some, > > -- > Stephen Checkoway > > > > > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlsym interposition question
by Stephen Checkoway 06 Oct '13

06 Oct '13

On Oct 6, 2013, at 4:33 PM, Ariel Burton <ariel.burton(a)roguewave.com> wrote: > Firstly, I'm not sure I made this clear. What I want to do > is to be able to locate the interposing implementation of > getpid and the underlying system-provided implementation > in the main program. > > On ELF-like systems dlopening the dynamic library explicitly > allows the definition in that library to be found. That's > not happening here. You can do that on Darwin too using RTLD_NOLOAD: void lookup_symbol(const char *name) { unsigned images = _dyld_image_count(); int num = 0; for (unsigned i = 0; i < images; ++i) { const char *path = _dyld_get_image_name(i); void *handle = dlopen(path, RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD | RTLD_FIRST); void *sym = dlsym(handle, name); if (sym) printf("%d: %u %s %p\n", num++, i, path, sym); dlclose(handle); } } With this in both a library containing a getpid() (libfoo.dyld) and in the main executable linking to the library, calling lookup_symbol("getpid") prints: 0: 1 /private/tmp/libfoo.dyld 0x102896cf0 1: 2 /usr/lib/libSystem.B.dylib 0x7fff8edecc2c 2: 19 /usr/lib/system/libsystem_kernel.dylib 0x7fff8edecc2c Likewise, from both libfoo.dyld, printing the address of getpid gives getpid from main: 0x102896cf0 getpid from library: 0x102896cf0 Hope that helps some, -- Stephen Checkoway _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlsym interposition question
by Ariel Burton 06 Oct '13

06 Oct '13

Jonas and Greg, Thanks for your replies. A number of comments. Firstly, I'm not sure I made this clear. What I want to do is to be able to locate the interposing implementation of getpid and the underlying system-provided implementation in the main program. On ELF-like systems dlopening the dynamic library explicitly allows the definition in that library to be found. That's not happening here. Secondly, dlsym ( RTLD_NEXT, "getpid" ) in the interposer finds the implementation in the interposer, not that in the system library. So in either case (main program or the interposer), how can one find the interposing and interposed implemetations? Thanks, Ariel Burton == On Fri 4 Oct 13:55, Greg Parker wrote: > On Oct 4, 2013, at 2:08 AM, Jonas Maebe <jonas.maebe(a)elis.ugent.be> wrote: > > On 04 Oct 2013, at 01:23, ariel.burton(a)roguewave.com wrote: > >> My question is this. How can I find the address of the > >> definition of getpid that was interposed (i.e., the one > >> in libSystem.dylib)? > > > > Calling dlsym with RTLD_NEXT should work for that, although the description for that parameter in the man page (at least under Mac OS X 10.5) seems to be wrong: > > > > *** > > If dlsym() is called with the special handle RTLD_NEXT, then the search for the symbol is limited to the images which were loaded after the one issuing the call to dlsym(). > > *** > > > > I think that should read "... images which were loaded *before* the one issuing the call ..." > > That depends on your point of view. The dynamic loader starts with the main executable and discovers the libraries it needs to load top-down, which means libSystem is "after" the app itself. But bindings and initializers run bottom-up, which means libSystem is "before" the app itself. > > Newer versions of the man page describe this more clearly: > If dlsym() is called with the special handle RTLD_NEXT, then dyld > searches for the symbol in the dylibs the calling image linked against > when built. ... > > > -- > Greg Parker gparker(a)apple.com Runtime Wrangler > > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-dev/ariel.burton%40roguewave… > > This email sent to ariel.burton(a)roguewave.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlsym interposition question
by Greg Parker 04 Oct '13

04 Oct '13

On Oct 4, 2013, at 2:08 AM, Jonas Maebe <jonas.maebe(a)elis.ugent.be> wrote: > On 04 Oct 2013, at 01:23, ariel.burton(a)roguewave.com wrote: >> My question is this. How can I find the address of the >> definition of getpid that was interposed (i.e., the one >> in libSystem.dylib)? > > Calling dlsym with RTLD_NEXT should work for that, although the description for that parameter in the man page (at least under Mac OS X 10.5) seems to be wrong: > > *** > If dlsym() is called with the special handle RTLD_NEXT, then the search for the symbol is limited to the images which were loaded after the one issuing the call to dlsym(). > *** > > I think that should read "... images which were loaded *before* the one issuing the call ..." That depends on your point of view. The dynamic loader starts with the main executable and discovers the libraries it needs to load top-down, which means libSystem is "after" the app itself. But bindings and initializers run bottom-up, which means libSystem is "before" the app itself. Newer versions of the man page describe this more clearly: If dlsym() is called with the special handle RTLD_NEXT, then dyld searches for the symbol in the dylibs the calling image linked against when built. ... -- Greg Parker gparker(a)apple.com Runtime Wrangler _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlsym interposition question
by Jonas Maebe 04 Oct '13

04 Oct '13

On 04 Oct 2013, at 01:23, ariel.burton(a)roguewave.com wrote: My question is this. How can I find the address of the definition of getpid that was interposed (i.e., the one in libSystem.dylib)? *** *** Jonas _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com Calling dlsym with RTLD_NEXT should work for that, although the description for that parameter in the man page (at least under Mac OS X 10.5) seems to be wrong: If dlsym() is called with the special handle RTLD_NEXT, then the search for the symbol is limited to the images which were loaded after the one issuing the call to dlsym(). I think that should read "... images which were loaded *before* the one issuing the call ..."

1 0

dlsym interposition question
by ariel.burton＠roguewave.com 03 Oct '13

03 Oct '13

Hi, I have the following question regarding how interposition and name lookups using dlsym interact. I have the following components: interposer.dylib this interposes getpid using the __interpose section main a main module I can interpose the getpid in libSystem by using DYLD_INSERT_LIBRARIES to preload interposer.dylib. main does the following: libc_handle = dlopen ( "/usr/lib/libSystem.dylib", RTLD_LAZY ); assert ( libc_handle ); interposer_handle = dlopen ( "interposer.dylib", RTLD_LAZY ); assert ( interposer_handle ); libc_getpid = dlsym ( libc_handle, "getpid" ); interposer_getpid = dlsym ( interposer_handle, "getpid" ); The instance of getpid returned by dlsym on libc_handle is that in the interposer, and is the same as that returned for the interposer_handle. My question is this. How can I find the address of the definition of getpid that was interposed (i.e., the one in libSystem.dylib)? Thanks, Ariel Burton _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.ap… This email sent to site_archiver(a)lists.apple.com

1 0