January 2008 - Darwin-kernel

Re: Darwin-kernel Digest, Vol 5, Issue 12
by David Tay 24 Jan '08

24 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=sbcglobal.net; h=Received:X-YMail-OSG:X-Yahoo-Newman-Property:Cc:Message-Id:From:To:In-Reply-To:Content-Type:Mime-Version:Subject:Date:References:X-Mailer; b=x/trR8ME6Jsc9nA2N5UbBF1peMAPBcPxYfMvgriJZRNNDXeNfcZbig/qqBBzzu4PkdS9l+T15RdgeqeFBbaFUDJJCMWpGPaoAfX3SxR29wEY8+iTWWkljpGXnsD9+2KumSPl2Qf6mcwNsBz4nzEW98aUM36igE4ZciwPtvmiKXA= ; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Panic writing kernel memory?
by Brian Doyle 24 Jan '08

24 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi Mike, Thanks for your reply! So... my original question still stands: Thanks again, Brian On Jan 24, 2008, at 1:34 AM, Michael Smith wrote: On Jan 24, 2008, at 1:09 AM, Brian Doyle wrote: I've written a kext which, quite simply, does this: typedef void (*CFunctionPointer)(void); baz = *foo; // read ok *foo = bar; // write panic The panic log states "Memory access exception (1,0,0)". Don't do that. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… As you've correctly surmised, I'm trying to patch the vtable of a class that isn't mine and that I can't inherit from (IODTNVRAM/ AppleEFINVRAM). My intent is to be notified when setProperty() is called on IODeviceTree:/options so that I can do some processing when the boot device changes. My code is written to just call through to the original pointer. The published headers have some "arcane evil code" in the form of OSMetaClassBase::_ptmf2ptf() that indicates a heavy reliance on the GCC 2.95 ABI (also -fapple-kext) so I feel confident that implementing this approach will work just fine provided I can find a way to write to the AppleEFINVRAM kext vtable. I could accomplish the same thing by polling iodt:/options but that is rather crufty, not nearly as reliable, and goes against my better nature ;-) Can anyone point out specific technical mechanics that will enable me to perform the write? If so I would greatly appreciate it. PS - Ultimately I suppose I'll have to resort to polling if no one can offer a better solution. Bummer. CFunctionPointer *foo = <some location containing a function pointer>; CFunctionPointer bar = <&some function>; CFunctionPointer baz; I'm guessing the memory I'm trying to write to has VM_PROT_WRITE disabled, but I'm not sure how to verify that (vm_region() on the address foo causes a different panic, namely a null-pointer dereference crash down in vm_map_lookup_entry()). I've noticed that when I'm two-machine debugging with gdb I can set the value *foo directly from the gdb command line with no problem. This is all well-and-good, but I need to be able to replace this function pointer from my kext. I gave vm_protect() a try but that crashed too, in the same place as vm_region(). Can anyone help? I would certainly appreciate it! If it's your function pointer, you should be able to manipulate it just fine. If it's not your function pointer, you should leave it alone. The way you wrote the above, it appears likely that you are trying to patch some part of the kernel. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Panic writing kernel memory?
by Michael Smith 24 Jan '08

24 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jan 24, 2008, at 1:09 AM, Brian Doyle wrote: I've written a kext which, quite simply, does this: typedef void (*CFunctionPointer)(void); baz = *foo; // read ok *foo = bar; // write panic The panic log states "Memory access exception (1,0,0)". Don't do that. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… CFunctionPointer *foo = <some location containing a function pointer>; CFunctionPointer bar = <&some function>; CFunctionPointer baz; I'm guessing the memory I'm trying to write to has VM_PROT_WRITE disabled, but I'm not sure how to verify that (vm_region() on the address foo causes a different panic, namely a null-pointer dereference crash down in vm_map_lookup_entry()). I've noticed that when I'm two-machine debugging with gdb I can set the value *foo directly from the gdb command line with no problem. This is all well-and-good, but I need to be able to replace this function pointer from my kext. I gave vm_protect() a try but that crashed too, in the same place as vm_region(). Can anyone help? I would certainly appreciate it! If it's your function pointer, you should be able to manipulate it just fine. If it's not your function pointer, you should leave it alone. The way you wrote the above, it appears likely that you are trying to patch some part of the kernel. This email sent to site_archiver(a)lists.apple.com

1 0

Panic writing kernel memory?
by Brian Doyle 24 Jan '08

24 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello, I've written a kext which, quite simply, does this: typedef void (*CFunctionPointer)(void); CFunctionPointer *foo = <some location containing a function pointer>; CFunctionPointer bar = <&some function>; CFunctionPointer baz; baz = *foo; // read ok *foo = bar; // write panic The panic log states "Memory access exception (1,0,0)". Can anyone help? I would certainly appreciate it! Thanks, Brian _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm guessing the memory I'm trying to write to has VM_PROT_WRITE disabled, but I'm not sure how to verify that (vm_region() on the address foo causes a different panic, namely a null-pointer dereference crash down in vm_map_lookup_entry()). I've noticed that when I'm two-machine debugging with gdb I can set the value *foo directly from the gdb command line with no problem. This is all well-and-good, but I need to be able to replace this function pointer from my kext. I gave vm_protect() a try but that crashed too, in the same place as vm_region(). This email sent to site_archiver(a)lists.apple.com

1 0

RE: Leopard - No filesystem icon on desktop
by Nick Blievers 17 Jan '08

17 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.0 (Macintosh/20070326) Hi, thanks for all the replies to what turned out to be a silly question :) Thanks again Nick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… The ytfs link is awesome, custom icons is something we have wanted for a long time.... however its unfortunate that the Finder will not show the mounted fs. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Dumping Entire Process Memory using vm_region
by Greg Miller 17 Jan '08

17 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=received:message-id:date:from:to:subject:cc:in-reply-to: mime-version:content-type:content-transfer-encoding: content-disposition:references; b=vgmL34+Zy6nnF4IDdzdgsDbY9FTuMdSzeY87uuxh9TkJpVnUWOPW9RN/7X9UT20Sp LWcGYS9suUqGI6DGtv18Q== On Jan 16, 2008 2:07 PM, David Weston <DAVID.G.WESTON(a)saic.com> wrote: > Hello All, > I would like to dump the entire writable memory space of a process to disk > (fwrite()) to be searched through. Can I use vm_region or some other api > call to find the boundaries of a process virtual memory? Can someone give > me an example? Take a look at http://www.osxbook.com/book/bonus/chapter8/core/, which also has source. G~ -- Greg Miller jgm(a)google.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Dumping Entire Process Memory using vm_region
by David Weston 16 Jan '08

16 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thread-index: AchYjD9Bfe+NzsR/EdyvHQAbY7jhxQ== Thread-topic: Dumping Entire Process Memory using vm_region User-agent: Microsoft-Entourage/11.3.6.070618 Hello All, I would like to dump the entire writable memory space of a process to disk (fwrite()) to be searched through. Can I use vm_region or some other api call to find the boundaries of a process virtual memory? Can someone give me an example? Thanks, David Weston Security Engineer Science Application International Corporation Web: http://www.saic.com/infosec Email:DAVID.G.WESTON@saic.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Leopard - No filesystem icon on desktop
by Terry Lambert 15 Jan '08

15 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com You might want to check the presentation and source code at: <http://inaddrany.com/macfuse/> -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jan 15, 2008, at 1:15 PM, Quinn wrote: At 15:06 -0500 15/1/08, Rick Macklem wrote: The above works for my nfsv4 client, but it never shows up on the left side of the Finder panel (under SHARED or whatever). Anyone happen to know what the trick is to make that happen? AFAIK there's no way to make that work. The side bar is generated by filtering the volumes using a fixed list of file system types. ps: I know, slightly off topic, but at least related. No worries. However, if you're looking for a more file system specific mailing list, try <http://lists.apple.com/mailman/listinfo/filesystem-dev >. The FUSE people (Google) demonstrated setting up icons for the FS and for the contents of the FS for synthetic data from Google's "Flickr equivalent last Thursday at the Cocoa Heads (Coca user group) meeting. It's a tutorial that walks you through setting up a new FS, from scratch, using XCode. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Leopard - No filesystem icon on desktop
by Quinn 15 Jan '08

15 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com The above works for my nfsv4 client, but it never shows up on the left side of the Finder panel (under SHARED or whatever). Anyone happen to know what the trick is to make that happen? S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 15:06 -0500 15/1/08, Rick Macklem wrote: AFAIK there's no way to make that work. The side bar is generated by filtering the volumes using a fixed list of file system types. ps: I know, slightly off topic, but at least related. No worries. However, if you're looking for a more file system specific mailing list, try <http://lists.apple.com/mailman/listinfo/filesystem-dev>. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Leopard - No filesystem icon on desktop
by Rick Macklem 15 Jan '08

15 Jan '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Tue, 15 Jan 2008, Quinn wrote: The above works for my nfsv4 client, but it never shows up on the left side of the Finder panel (under SHARED or whatever). Anyone happen to know what the trick is to make that happen? Thanks in advance for any help, rick ps: I know, slightly off topic, but at least related. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 15:00 +0800 15/1/08, Nick Blievers wrote: However, no desktop icon is appearing. The Finder in 10.5 has a preference for whether to show server volumes on the desktop, and it defaults to /off/. Make sure Finder > Preferences > General Connected Servers is checked. This email sent to site_archiver(a)lists.apple.com

1 0