December 2008 - Darwin-kernel

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by Michael Smith 15 Dec '08

15 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Dec 14, 2008, at 7:47 PM, John D. wrote: No, the "problem" here is that it's inconvenient for *you*. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Yes. On purpose. I personally made the syscall table a private symbol. The problem is that it's a hassle for legitimate developers. You need to realise that "legitimate developers" have a broad variety of concerns, many of which you have either discounted elsewhere in this thread, or which possibly haven't occurred to you yet. One of those legitimate concerns is the availability of stable, supported interfaces. Those stable, supported interfaces are, in the Darwin world, referred to as KPI. They are what you get to play with. If what you want to do can't be done via KPI, you have two options: - Explain what it is you're doing, and why you want KPI to support the activity. In time, if an interface can be created that will be supportable and sustainable, then your request may result in changes to KPI. - Build your own kernel from publically available sources, and use that. Incidentally, users like stable, supported interfaces as well. The sort of monkey business you're talking about tends to fail spectacularly, and they don't like that. Typically when something stupid breaks. users come running and complaining to Apple, despite the fact that it's a third party that's wilfully ignored both established guidelines and basic common sense. This email sent to site_archiver(a)lists.apple.com

1 0

Obtaining data (packet body) from TCP packet via ipf_input_func
by John D. 15 Dec '08

15 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=nTLtkNEveDJyJ3OO3p6htvK5QvCRtDzjOHCkZQ6HqQY=; b=UQIo4PoTmm5y6hz0IQjnVUkcJrtqFppQ0xDA6r314RiTA9i9fQ/8QFlXvn7reEtpWV LHm5YI/kUuUJYknB9y+p8gaJLr8uidQ9utIWg2r+CwysCKB9Z2jc/uUbgYEq/KwYAPjS yZEzK4qDX+HuVyuQDmks7LEKGpB+QwbbtVtEI= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=jXOKYcFkObESghml66LXTjbP1tiyZq55RrXkwSuIt6n5SXXB4+Shq0p0FtfQwHXeU4 aQhWvofL9DEovxIL5w9hgybwoVKFiqvQ3MfcVM6UIvZX6JXIjbkddzJkRdiqxwaYUsEt O7vzVB0n4xQ3D50tnrrUmYh8EKzu4l4Fn6zog= Hi, Finally I figured out how the mbuf_t is handled and how to extract information via mbuf_copydata() (which takes an offset parameter, thus making things easier). But I still don't know how to copy or access (as in directly accessing the pointer and inner buffer holding the data) the packet body (post-TCP/UDP header and obviously post-IP header too). Any help will be appreciated. John. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by John D. 15 Dec '08

15 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=Slxt51ZTQI9RRx4grFxUTcV5ixg6y6Uf0en3B9zPtT0=; b=Z20rwr2Va+QRgcmWJiBeSpJeFy9K9SZ6kFEdH3kUwJklQCBQ7xJgqi7gC47ClUHdmZ Bii7U7q4I2uFD+pncS14yjWvIsochdaxiRHIJmFPQ+rH5vNuQh0Q3q+cI96PebWnSjQs faPtGdjtNyJP7Zw7fhV3NeeZMJunvu5o0L8MY= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=dZszeYFppKhJ9Go8XzoJH8swfcvxsGCvO1QL/0dXnKa0Ecm7SjG2OxLzKMW2TCffG7 Nb/xVmPlBFUrRi0xNZejTR3uu1/fi/QeLzZXPLnVktLx/eBiap1JAPnAm4YwsvhyaEs+ PAUtFtKjxiqAOR53Ov2ZH4yMvaGJ0BGD6c2yg= Hi Rick, > 1 - You can create your Kext against the entire kernel instead of > supported KPI bundles, by putting the following in the Info.plist > for the Kext. > <key>OSBundleLibraries</key> > <dict> > <key>com.apple.kernel</key> > <string>9.5.0</string> > </dict> > Then, you can link to any global symbol in "/mach_kernel". > (For example, chgproccnt() is one of these.) You will probably > need the open kernel sources to use as documentation and you > can find out what is global via "nm -g /mach_kernel" and looking > for the symbols. This is what I'm using right now: <key>com.apple.kernel.bsd</key> <key>com.apple.kernel.iokit</key> <key>com.apple.kernel.libkern</key> <key>com.apple.kernel.mach</key> <key>com.apple.kpi.libkern</key> <key>com.apple.kpi.bsd</key> I will check with linking to the whole kernel. I wanted to keep my KEXT compatible across future versions so I wrote some function hash search code to find APIs I require when I can't find them around. > 2 - If that doesn't get what you want, because the routine you need is > non-global, you can crib it (making sure the resultant source > file has the APSL on it and it handled in accordance with the APSL). > This works if the routine doesn't use "private" globals or you can > get a set of routines cribbed, so that you get to that state. > (Obviously risky and you may need to re-crib them each time a new > xnu-1228 source tree is released.) > * Holy Bogosity Batman!. To hijack the nfssvc syscall, > * I need to fiddle with the sysent table, but it's defined > * __private_extern__, so I use nsysent to get a pointer to it. > * The trick is that nsysent is right next to the table, either > * just before or just after it. (Not right after it, though:-) > * First, try just before and then just after. > */ > if (mysysentptr == NULL) { > mysysentptr = (struct sysent *)&nsysent; > mysysentptr -= nsysent; > if (mysysentptr[SYS_nfssvc].sy_call != (sy_call_t *)nfssvc) { > tptr = &nsysent; > do { > tptr++; > mysysentptr = (struct sysent *)tptr; > } while (mysysentptr[SYS_nfssvc].sy_call != > (sy_call_t *)nfssvc && tptr < &kdebug_chudhook); > } I would implement the loop in a different manner. You can check Landon F's code in his website. You should limit the search to a reasonable boundary. If for some reason the sy_call comparison fails, you might be receiving a wrong location in the best case, or reading past end of memory in the worse (given that no false positive matches of the pointer exist across kernel memory). Useful code nonetheless. I use something similar but I don't patch sysent, it's for parsing some code elsewhere. > Not recommended and only to be used if you understand the implications, > but they work for me. (I've actually been lucky and my Kext hasn't needed > to be changed for 9.0.0->9.5.0, but I expect to get bit soon:-) Nice, my main concern is portability across updates of the same major version (10.5.x). I've added some safety checks to avoid loading certain features but I would rather want my KEXT to work across all minor revisions. John. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by John D. 15 Dec '08

15 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=mQMBk/KMDfh7AHbYwy/YiwDjm0MCgIT5oylScLUyzPg=; b=krcWF17a9pnKAcuMpywNIBSnBEpKuomqNr+I69ao3sDmht1MsUH4hnJMV6QJL2Rk0u B9Vy0dxWpiEt89nmxSnh0WnQzLG40LqD0fEWcC2fj3CPHuzp6wuOZ4RfFXMAk4/oTPmv T04kBMkt0C3tNhavoYG0O9X2HdJ5UU/Nh8y1w= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=nOSVGa5KmD+0W4bZ8DYGARFmbP17Sl4qUgYRj7uwz9lXY26YZ2g4fShwPGkPluJ8q1 9s8OS2Yqk4vEh6L4Q+G5uzwFUKZibPePYkNAE5W3wPk2wfVE7RGWeUgLQUhDWdPufsEo NJ6gnAh4zCVs6a+mcXtQGwMfrXV0Vhttbi72Q= On Sun, Dec 14, 2008 at 8:33 PM, Terry Lambert <tlambert(a)apple.com> wrote: > You file a bug report with DTS. OK, thanks. > This is something we intentionally do not permit. A lot of antivirus vendors > were doing this and it broke our locking model. So we provided KPI to let > them intercept operations (that is called "kauth" and you can find > documentation on <http://developer.apple.com>). If we change locking in the > future, we won't break them again. Problem with kauth is that AFAIK it only let's you return 'deny' or 'pass' results. If, say, you want to return a ENOENT or special errno to the syscall, it's not possible through kauth. >> Most of the API used in unix_syscall isn't available in any KPI. > > Yes. On purpose. I personally made the syscall table a private symbol. The problem is that it's a hassle for legitimate developers. People trying to subvert the kernel might simply go and patch the IDT or do something far more complex. Plus a memory search will yield sysent's location easily. >> That >> leaves us with either patching its code on runtime (a hack, which >> apparently isn't possible because that region isn't writable; I'm not >> sure why kernel TEXT wouldn't be writable except for security reasons >> I guess) or forgetting about implementing anything around it. > > We're mildly clever that way. I was hoping we could vm_map_mprotect or alike the kernel text temporarily. Do you know if this is feasible without resorting to a non portable hack? John. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by Terry Lambert 14 Dec '08

14 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com What would be the process to request a KPI to be made available? We are talking about exporting a handful functions here. You file a bug report with DTS. Let's say I want to emulate / write my own unix_syscall dispatcher for introducing some process status tracking code or collecting stats or information about registers or anything I need to do explicitly within the context of the unix_syscall function, but implementing my own code along with it. Yes. On purpose. I personally made the syscall table a private symbol. That leaves us with either patching its code on runtime (a hack, which apparently isn't possible because that region isn't writable; I'm not sure why kernel TEXT wouldn't be writable except for security reasons I guess) or forgetting about implementing anything around it. We're mildly clever that way. -- Terry A KPI that provides us with means of resolving a kernel symbol from a kext would be extremely handy. I could understand that we want certain symbols to be restricted, but this would let us solve many issues. Whether it's from the running kernel or from a file on the root disk is not really important. John. You are trying to do something for which there is no KPI. -- Terry On Dec 14, 2008, at 8:13 AM, "John D." <johndenkar(a)gmail.com> wrote: John. On Dec 12, 2008, at 8:15 PM, John D. wrote: You will need to build your own kernel. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/tlambert%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Dec 14, 2008, at 9:08 AM, "John D." <johndenkar(a)gmail.com> wrote: This is something we intentionally do not permit. A lot of antivirus vendors were doing this and it broke our locking model. So we provided KPI to let them intercept operations (that is called "kauth" and you can find documentation on <http://developer.apple.com>). If we change locking in the future, we won't break them again. Most of the API used in unix_syscall isn't available in any KPI. On Sun, Dec 14, 2008 at 5:50 PM, Terry Lambert <tlambert(a)apple.com> wrote: You can ask for KPI (which you might not get) or you can build your own kernel. Basically you are asking us to not change what we consider implementation details. We want them to be fungible so we can implement more efficient algorithms at a later date. Doing so will break your code. That's just messed up. This is a KEXT, I can't force people to rebuild the kernel or patch it right away. I guess I will have to search memory with a function hash of sorts, but seems like a hack. I don't know why Apple decided to stop exporting some really useful API (namely some kauth and proc functions), plus restricting access to proc structure definitions by providing a crippled public one. My KEXT project is related with collecting statistics of processes so the non exported API is a bummer. On Sat, Dec 13, 2008 at 5:35 AM, Michael Smith <drivers(a)mu.org> wrote: I'm working on a college project and I would like to access some non-exported API. For example chgproccnt and kld_file_lookupsymbol. I want to be able to obtain a symbol address from a kernel extension, say, of the mach_kernel file. This could come handy but apparently none of the useful API is available to extensions. Has anyone done anything similar or can provide a suggestion to access kld_file_lookupsymbol() without using static addresses (to avoid version-specific builds, since Apple can change it anytime). This email sent to tlambert(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by Shantonu Sen 14 Dec '08

14 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Shantonu Sent from my MacBook On Dec 14, 2008, at 12:32 PM, Rick Macklem wrote: On Sat, 13 Dec 2008, John D. wrote: Hi, I'm working on a college project and I would like to access some non-exported API. For example chgproccnt and kld_file_lookupsymbol. I want to be able to obtain a symbol address from a kernel extension, say, of the mach_kernel file. This could come handy but apparently none of the useful API is available to extensions. Has anyone done anything similar or can provide a suggestion to access kld_file_lookupsymbol() without using static addresses (to avoid version-specific builds, since Apple can change it anytime). 1 - You can create your Kext against the entire kernel instead of supported KPI bundles, by putting the following in the Info.plist for the Kext. <key>OSBundleLibraries</key> <dict> <key>com.apple.kernel</key> <string>9.5.0</string> </dict> Then, you can link to any global symbol in "/mach_kernel". (For example, chgproccnt() is one of these.) You will probably need the open kernel sources to use as documentation and you can find out what is global via "nm -g /mach_kernel" and looking for the symbols. Good luck with it, rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/ssen%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… If you're doing things for every syscall, you should consider implementing this with a DTrace script using the "syscall" provider. Yes, the kernel text is not writable to prevent malicious (or unintentional) corruption. Linking against the "whole kernel" may not work in the future for all configurations and architectures. Since you note that it is a college project (which sounds like it is similar in spirit to my open source experimental kext), here's a few things I've done to get around this problem. If you do any of these you will end up with a Kext that could break horribly whenever a new version of the mach_kernel is released by Apple. If you can live with this, here goes... 2 - If that doesn't get what you want, because the routine you need is non-global, you can crib it (making sure the resultant source file has the APSL on it and it handled in accordance with the APSL). This works if the routine doesn't use "private" globals or you can get a set of routines cribbed, so that you get to that state. (Obviously risky and you may need to re-crib them each time a new xnu-1228 source tree is released.) 3 - If you need to figure out where a private global is, you might be able to locate it based on knowing that the linker has it between two globals that you can link to. (To make this even more fun, the linking used for PPC vs Intel kernels results in slightly different orderings, ergo the just before or after.) All readers can now prepare to puke (or maybe just laugh) at the following code I use to do that for one case: /* * Holy Bogosity Batman!. To hijack the nfssvc syscall, * I need to fiddle with the sysent table, but it's defined * __private_extern__, so I use nsysent to get a pointer to it. * The trick is that nsysent is right next to the table, either * just before or just after it. (Not right after it, though:-) * First, try just before and then just after. */ if (mysysentptr == NULL) { mysysentptr = (struct sysent *)&nsysent; mysysentptr -= nsysent; if (mysysentptr[SYS_nfssvc].sy_call != (sy_call_t *)nfssvc) { tptr = &nsysent; do { tptr++; mysysentptr = (struct sysent *)tptr; } while (mysysentptr[SYS_nfssvc].sy_call != (sy_call_t *)nfssvc && tptr < &kdebug_chudhook); } if (mysysentptr[SYS_nfssvc].sy_call != (sy_call_t *)nfssvc) { mysysentptr = NULL; printf("couldn't hijack nfssvc\n"); return (EINVAL); } } Not recommended and only to be used if you understand the implications, but they work for me. (I've actually been lucky and my Kext hasn't needed to be changed for 9.0.0->9.5.0, but I expect to get bit soon:-) This email sent to ssen(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by Rick Macklem 14 Dec '08

14 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sat, 13 Dec 2008, John D. wrote: Hi, I'm working on a college project and I would like to access some non-exported API. For example chgproccnt and kld_file_lookupsymbol. I want to be able to obtain a symbol address from a kernel extension, say, of the mach_kernel file. This could come handy but apparently none of the useful API is available to extensions. Has anyone done anything similar or can provide a suggestion to access kld_file_lookupsymbol() without using static addresses (to avoid version-specific builds, since Apple can change it anytime). 1 - You can create your Kext against the entire kernel instead of supported KPI bundles, by putting the following in the Info.plist for the Kext. <key>OSBundleLibraries</key> <dict> <key>com.apple.kernel</key> <string>9.5.0</string> </dict> Then, you can link to any global symbol in "/mach_kernel". (For example, chgproccnt() is one of these.) You will probably need the open kernel sources to use as documentation and you can find out what is global via "nm -g /mach_kernel" and looking for the symbols. 2 - If that doesn't get what you want, because the routine you need is non-global, you can crib it (making sure the resultant source file has the APSL on it and it handled in accordance with the APSL). This works if the routine doesn't use "private" globals or you can get a set of routines cribbed, so that you get to that state. (Obviously risky and you may need to re-crib them each time a new xnu-1228 source tree is released.) 3 - If you need to figure out where a private global is, you might be able to locate it based on knowing that the linker has it between two globals that you can link to. (To make this even more fun, the linking used for PPC vs Intel kernels results in slightly different orderings, ergo the just before or after.) All readers can now prepare to puke (or maybe just laugh) at the following code I use to do that for one case: /* * Holy Bogosity Batman!. To hijack the nfssvc syscall, * I need to fiddle with the sysent table, but it's defined * __private_extern__, so I use nsysent to get a pointer to it. * The trick is that nsysent is right next to the table, either * just before or just after it. (Not right after it, though:-) * First, try just before and then just after. */ if (mysysentptr == NULL) { mysysentptr = (struct sysent *)&nsysent; mysysentptr -= nsysent; if (mysysentptr[SYS_nfssvc].sy_call != (sy_call_t *)nfssvc) { tptr = &nsysent; do { tptr++; mysysentptr = (struct sysent *)tptr; } while (mysysentptr[SYS_nfssvc].sy_call != (sy_call_t *)nfssvc && tptr < &kdebug_chudhook); } if (mysysentptr[SYS_nfssvc].sy_call != (sy_call_t *)nfssvc) { mysysentptr = NULL; printf("couldn't hijack nfssvc\n"); return (EINVAL); } } Not recommended and only to be used if you understand the implications, but they work for me. (I've actually been lucky and my Kext hasn't needed to be changed for 9.0.0->9.5.0, but I expect to get bit soon:-) Good luck with it, rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Since you note that it is a college project (which sounds like it is similar in spirit to my open source experimental kext), here's a few things I've done to get around this problem. If you do any of these you will end up with a Kext that could break horribly whenever a new version of the mach_kernel is released by Apple. If you can live with this, here goes... This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by John D. 14 Dec '08

14 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=DE/kgh1bb/N5LHs39hm2msmyGbp4UwtFSzgdd7xv/wI=; b=Sr2M2dZncqHAgT+/0LOyXIzEex1bku31+Xb41fntKkW52dIcIa1DSHcQ6H42s9othB UMfFJZUlEO+4pHkaTN3ANWgwic48MRQbcbpTYQq5q7/uBXp+TrU5hH5KY8XfkW2JLF79 CsZP8DrMEBYhaSmfPjDVOa32EmR9lmJNJf9MM= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=ttESbJsgsGrQsvV6ZEv4DmmgkYyRLAUE1g23pOmhjvYwnQmz27WWcmKoy58aXa5jau g9gVOjofZ0xnmSCD5YKAzDuhJSF8iyeMd+RwoIQ+7+wbyqh8ASFoD9GNnLkjH+SMNPWd W1qlIWwkWsgdX6olMfaBJ62Z+6xMLmm8qwuXM= What would be the process to request a KPI to be made available? We are talking about exporting a handful functions here. Let's say I want to emulate / write my own unix_syscall dispatcher for introducing some process status tracking code or collecting stats or information about registers or anything I need to do explicitly within the context of the unix_syscall function, but implementing my own code along with it. Most of the API used in unix_syscall isn't available in any KPI. That leaves us with either patching its code on runtime (a hack, which apparently isn't possible because that region isn't writable; I'm not sure why kernel TEXT wouldn't be writable except for security reasons I guess) or forgetting about implementing anything around it. A KPI that provides us with means of resolving a kernel symbol from a kext would be extremely handy. I could understand that we want certain symbols to be restricted, but this would let us solve many issues. Whether it's from the running kernel or from a file on the root disk is not really important. John. On Sun, Dec 14, 2008 at 5:50 PM, Terry Lambert <tlambert(a)apple.com> wrote: > You are trying to do something for which there is no KPI. > > You can ask for KPI (which you might not get) or you can build your own > kernel. Basically you are asking us to not change what we consider > implementation details. We want them to be fungible so we can implement more > efficient algorithms at a later date. Doing so will break your code. > > -- Terry > > > On Dec 14, 2008, at 8:13 AM, "John D." <johndenkar(a)gmail.com> wrote: > >> That's just messed up. This is a KEXT, I can't force people to rebuild >> the kernel or patch it right away. >> I guess I will have to search memory with a function hash of sorts, >> but seems like a hack. I don't know why Apple decided to stop >> exporting some really useful API (namely some kauth and proc >> functions), plus restricting access to proc structure definitions by >> providing a crippled public one. >> >> My KEXT project is related with collecting statistics of processes so >> the non exported API is a bummer. >> >> John. >> >> On Sat, Dec 13, 2008 at 5:35 AM, Michael Smith <drivers(a)mu.org> wrote: >>> >>> On Dec 12, 2008, at 8:15 PM, John D. wrote: >>> >>>> I'm working on a college project and I would like to access some >>>> non-exported API. For example chgproccnt and kld_file_lookupsymbol. I >>>> want to be able to obtain a symbol address from a kernel extension, >>>> say, of the mach_kernel file. This could come handy but apparently >>>> none of the useful API is available to extensions. Has anyone done >>>> anything similar or can provide a suggestion to access >>>> kld_file_lookupsymbol() without using static addresses (to avoid >>>> version-specific builds, since Apple can change it anytime). >>> >>> You will need to build your own kernel. >>> >>> = Mike >>> >>> >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> http://lists.apple.com/mailman/options/darwin-kernel/tlambert%40apple.com >> >> This email sent to tlambert(a)apple.com > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by Terry Lambert 14 Dec '08

14 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com You are trying to do something for which there is no KPI. -- Terry On Dec 14, 2008, at 8:13 AM, "John D." <johndenkar(a)gmail.com> wrote: That's just messed up. This is a KEXT, I can't force people to rebuild the kernel or patch it right away. I guess I will have to search memory with a function hash of sorts, but seems like a hack. I don't know why Apple decided to stop exporting some really useful API (namely some kauth and proc functions), plus restricting access to proc structure definitions by providing a crippled public one. My KEXT project is related with collecting statistics of processes so the non exported API is a bummer. John. On Dec 12, 2008, at 8:15 PM, John D. wrote: You will need to build your own kernel. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/tlambert%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… You can ask for KPI (which you might not get) or you can build your own kernel. Basically you are asking us to not change what we consider implementation details. We want them to be fungible so we can implement more efficient algorithms at a later date. Doing so will break your code. On Sat, Dec 13, 2008 at 5:35 AM, Michael Smith <drivers(a)mu.org> wrote: I'm working on a college project and I would like to access some non-exported API. For example chgproccnt and kld_file_lookupsymbol. I want to be able to obtain a symbol address from a kernel extension, say, of the mach_kernel file. This could come handy but apparently none of the useful API is available to extensions. Has anyone done anything similar or can provide a suggestion to access kld_file_lookupsymbol() without using static addresses (to avoid version-specific builds, since Apple can change it anytime). This email sent to tlambert(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by John D. 14 Dec '08

14 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=UQydoebTA19oN/xKVjWU42O37PTmQSCoi5MJr3l1KSQ=; b=eB9pSo17cYOdK77p6Gfd6211BBDb1as3rFFUxlKU4iNrsc7pJAE5Wuh4T5LwHVqG5k PCuOKP8rPV5yUT9o8S5xfr9oZ75085GIIkk89Lk8XS+GtU5wb5+Q0h/Ffth5bF66G8MF BfdEGCw23DGMDXSPCP2JgZJnrL4UynLbgQ7Fs= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=am6NSCCzhJQPRzaxf/CqyQ2B+FM2Lvbm1YvBIVZKr2BQzDMOGYUxdhXBzovKcVPlqk X+4QVsFrilM4Zl/+7zLvIQ/fkY2mz7zYrCHh34YSZsEmg7yWSHan595DTN6H0THkJ768 oC/oyfL1njX2icz9AyBv5L3tiNFju3Y2VPZe4= That's just messed up. This is a KEXT, I can't force people to rebuild the kernel or patch it right away. I guess I will have to search memory with a function hash of sorts, but seems like a hack. I don't know why Apple decided to stop exporting some really useful API (namely some kauth and proc functions), plus restricting access to proc structure definitions by providing a crippled public one. My KEXT project is related with collecting statistics of processes so the non exported API is a bummer. John. On Sat, Dec 13, 2008 at 5:35 AM, Michael Smith <drivers(a)mu.org> wrote: > > On Dec 12, 2008, at 8:15 PM, John D. wrote: > >> I'm working on a college project and I would like to access some >> non-exported API. For example chgproccnt and kld_file_lookupsymbol. I >> want to be able to obtain a symbol address from a kernel extension, >> say, of the mach_kernel file. This could come handy but apparently >> none of the useful API is available to extensions. Has anyone done >> anything similar or can provide a suggestion to access >> kld_file_lookupsymbol() without using static addresses (to avoid >> version-specific builds, since Apple can change it anytime). > > You will need to build your own kernel. > > = Mike > > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0