April 2012 - Darwin-kernel - lists.apple.com

Deleting a file in KEXT
by Rupesh Khetawat 09 Apr '12

09 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

strange vmaddr in infoArray of 32-Bit process
by Gerriet M. Denkmann 09 Apr '12

09 Apr '12

I am reading the dyld_all_image_infos->infoArray of another process. All looks good. But for some 32-bit processes I get strange results. E.g. a process has 15 infoArrays (out of a total of 202) which have a header with flags 0x100085, filetype 0x6; the imageFilePath of the first of these is: /System/Library/Frameworks/OpenCL.framework/Libraries/libcldcpuengine.dylib and another 4 with flags 0x85, filetype 0x8 - these all have the imageFilePath = cl_kernels. The problem: the LC_SEGMENTs of these 19 strange infoArrays have vmaddr which are NOT the same, as the result of vmmmap. The content of vmaddr + size = 0-06000 -- but vmmap has: __TEXT 03786000-0378c000 [ 24K] r-x/rwx SM=COW /System/Library/Frameworks/OpenCL.framework/Versions/A/Libraries/libcldcpuengine.dylib That is: the header has the original (unshifted) address. How do I know their real address? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

How to know whether image uses sharedCacheSlide
by Gerriet M. Denkmann 07 Apr '12

07 Apr '12

The following code snipped (all error processing omitted for brevity) seems to work, but I am rather troubled by using the UNDEFINED_HEADER_FLAG. Could anybody please either confirm that this is ok or suggest a better way? Kind regards, Gerriet. Code: task_name_t target_task = mach_task_self(); // → task_for_pid(...,) task_dyld_info_data_t infoData; mach_msg_type_number_t task_info_outCnt = TASK_DYLD_INFO_COUNT; kern_return_t kr = task_info( target_task, TASK_DYLD_INFO, (task_info_t)&infoData, &task_info_outCnt ); struct dyld_all_image_infos *allImageInfos = (struct dyld_all_image_infos *)infoData.all_image_info_addr; const struct dyld_image_info *infoArray = allImageInfos->infoArray; for( NSUInteger i = 0; i < allImageInfos->infoArrayCount; i++ ) { const struct mach_header *head1 = infoArray[i].imageLoadAddress; if ( head1->magic == MH_MAGIC_64 ) { const struct mach_header_64 *head64 = (const struct mach_header_64 *)infoArray[i].imageLoadAddress; #define UNDEFINED_HEADER_FLAG 0x80000000 // NOT in mach-o/loader.h BOOL useSharedCacheSlide = ( head64->flags & UNDEFINED_HEADER_FLAG ) != 0; BOOL slideDefined = NO; const void *voidPointer = head64 + 1; for( NSUInteger lc = 0; lc < head64->ncmds; lc++ ) { const struct load_command *lc1 = voidPointer; if ( lc1->cmd == LC_SEGMENT_64 ) { const struct segment_command_64 *seg = voidPointer; if ( strcmp( "__PAGEZERO", seg->segname ) != 0 ) { if ( useSharedCacheSlide ) { ourSlide = allImageInfos->sharedCacheSlide; slideDefined = YES; } else if ( !slideDefined && strcmp( "__TEXT", seg->segname ) == 0 ) { ourSlide = (uint64_t)infoArray[i].imageLoadAddress - seg->vmaddr; slideDefined = YES; }; if ( !slideDefined ) // error... // print similar to vmmap uint64_t loadedAddress = seg->vmaddr + ourSlide; fprintf(stderr,"%-22s %016llx-%016llx [%5lluK]\n", seg->segname, loadedAddress, loadedAddress + seg->vmsize, seg->vmsize / 1024); }; }; voidPointer += lc1->cmdsize ; }; }; }; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get the slide of another process
by Gerriet M. Denkmann 06 Apr '12

06 Apr '12

On 6 Apr 2012, at 22:27, Shantonu Sen wrote: > What are you trying to do? If you don't have experience with mach_vm_read, why do you care about other processes' slide? I am trying to make my own vmmap. And learning lots of things, among others how to use mach_vm_read. > On Apr 6, 2012, at 3:59 AM, "Gerriet M. Denkmann" <gerriet(a)mdenkmann.de> wrote: > >> >> On 5 Apr 2012, at 23:05, Joseph Ranieri wrote: >> >>> On Thu, Apr 5, 2012 at 11:49 AM, Gerriet M. Denkmann >>> <gerriet(a)mdenkmann.de> wrote: >>>> >>>> On 5 Apr 2012, at 15:31, Quinn The Eskimo! wrote: >>>> >>>>> On 4 Apr 2012, at 12:28, Gerriet M. Denkmann wrote: >>>>> >>>>>> Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the slide of it? >>>>> >>>>> One way to do it--and I'm certainly not sure that this is the best way--is to find dyld and then use the dyld debug interface to find all the images in the process. >>>> >>>> Could you be a bit more specific? >>>> >>>> I don't know how to "find dyld". >>>> Do you mean find a memory region starting at 'a' where proc_regionfilename( pid, a, ... ) gives: "/usr/lib/dyld" ? >>>> >>>> If so, there are typically about half a dozen of those. >>>> >>>> And where (in which header file?) is the "dyld debug interface" documented? >>> >>> Basically you need to find dyld_all_image_infos in the remote process. >>> gdb uses task_info passing in TASK_DYLD_INFO to get the address. lldb >>> also has to find the symbol, but I'm not certain how it does it and >>> couldn't find it quickly in the source code. >>> >>> Once you've found the address, it's fairly trivial to read from it via >>> the Mach APIs. Just keep in mind that you might be inspecting a 32-bit >>> process from a 64-bit process or the other way around. >> >> I got this: >> >> - (uint64_t)localAddressFor: (uint64_t)addressInTargetTask size: (uint64_t)sizeInBytes inTask: (vm_map_t)target_task >> { >> uint64_t pagesize = getpagesize(); >> uint64_t mask = pagesize - 1; >> >> mach_vm_address_t startAddress = (mach_vm_address_t)addressInTargetTask; >> mach_vm_address_t endAddress = startAddress + sizeInBytes; >> mach_vm_address_t baseAdr1 = startAddress & ~mask; >> mach_vm_address_t baseAdr2 = endAddress & ~mask; >> mach_vm_size_t size = baseAdr2 - baseAdr1 + pagesize; >> mach_msg_type_number_t dataCnt; >> vm_offset_t data; >> kern_return_t kr = mach_vm_read ( target_task, >> baseAdr1, >> size, >> &data, >> &dataCnt >> ); >> if ( kr != KERN_SUCCESS ) // error ... >> if ( dataCnt != size ) // error ... >> >> mach_vm_address_t lowAdr = startAddress & mask; >> uint64_t localAddress = data + lowAdr; >> return localAddress; >> } >> >> This seems to work. >> Any obvious errors? >> Do I have to release (free) the "data" pointer? >> >> One problem: calling this method twice with the same arguments results in different "data" being returned. >> Any way to fix this? Or do I just have to keep a list of already translated addresses? >> _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get the slide of another process
by Shantonu Sen 06 Apr '12

06 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get the slide of another process
by Gerriet M. Denkmann 06 Apr '12

06 Apr '12

On 5 Apr 2012, at 23:05, Joseph Ranieri wrote: > On Thu, Apr 5, 2012 at 11:49 AM, Gerriet M. Denkmann > <gerriet(a)mdenkmann.de> wrote: >> >> On 5 Apr 2012, at 15:31, Quinn The Eskimo! wrote: >> >>> On 4 Apr 2012, at 12:28, Gerriet M. Denkmann wrote: >>> >>>> Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the slide of it? >>> >>> One way to do it--and I'm certainly not sure that this is the best way--is to find dyld and then use the dyld debug interface to find all the images in the process. >> >> Could you be a bit more specific? >> >> I don't know how to "find dyld". >> Do you mean find a memory region starting at 'a' where proc_regionfilename( pid, a, ... ) gives: "/usr/lib/dyld" ? >> >> If so, there are typically about half a dozen of those. >> >> And where (in which header file?) is the "dyld debug interface" documented? > > Basically you need to find dyld_all_image_infos in the remote process. > gdb uses task_info passing in TASK_DYLD_INFO to get the address. lldb > also has to find the symbol, but I'm not certain how it does it and > couldn't find it quickly in the source code. > > Once you've found the address, it's fairly trivial to read from it via > the Mach APIs. Just keep in mind that you might be inspecting a 32-bit > process from a 64-bit process or the other way around. I got this: - (uint64_t)localAddressFor: (uint64_t)addressInTargetTask size: (uint64_t)sizeInBytes inTask: (vm_map_t)target_task { uint64_t pagesize = getpagesize(); uint64_t mask = pagesize - 1; mach_vm_address_t startAddress = (mach_vm_address_t)addressInTargetTask; mach_vm_address_t endAddress = startAddress + sizeInBytes; mach_vm_address_t baseAdr1 = startAddress & ~mask; mach_vm_address_t baseAdr2 = endAddress & ~mask; mach_vm_size_t size = baseAdr2 - baseAdr1 + pagesize; mach_msg_type_number_t dataCnt; vm_offset_t data; kern_return_t kr = mach_vm_read ( target_task, baseAdr1, size, &data, &dataCnt ); if ( kr != KERN_SUCCESS ) // error ... if ( dataCnt != size ) // error ... mach_vm_address_t lowAdr = startAddress & mask; uint64_t localAddress = data + lowAdr; return localAddress; } This seems to work. Any obvious errors? Do I have to release (free) the "data" pointer? One problem: calling this method twice with the same arguments results in different "data" being returned. Any way to fix this? Or do I just have to keep a list of already translated addresses? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get the slide of another process
by Gerriet M. Denkmann 06 Apr '12

06 Apr '12

On 5 Apr 2012, at 23:05, Joseph Ranieri wrote: > On Thu, Apr 5, 2012 at 11:49 AM, Gerriet M. Denkmann > <gerriet(a)mdenkmann.de> wrote: >> >> On 5 Apr 2012, at 15:31, Quinn The Eskimo! wrote: >> >>> On 4 Apr 2012, at 12:28, Gerriet M. Denkmann wrote: >>> >>>> Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the slide of it? >>> >>> One way to do it--and I'm certainly not sure that this is the best way--is to find dyld and then use the dyld debug interface to find all the images in the process. >> >> Could you be a bit more specific? >> >> I don't know how to "find dyld". >> Do you mean find a memory region starting at 'a' where proc_regionfilename( pid, a, ... ) gives: "/usr/lib/dyld" ? >> >> If so, there are typically about half a dozen of those. >> >> And where (in which header file?) is the "dyld debug interface" documented? > > Basically you need to find dyld_all_image_infos in the remote process. > gdb uses task_info passing in TASK_DYLD_INFO to get the address. lldb > also has to find the symbol, but I'm not certain how it does it and > couldn't find it quickly in the source code. I got this (all error checking omitted for brevity): kern_return_t kr; task_name_t target_task = mach_task_self(); task_flavor_t flavor = TASK_DYLD_INFO; task_dyld_info_data_t infoData; mach_msg_type_number_t task_info_outCnt = TASK_DYLD_INFO_COUNT; kr = task_info ( target_task, flavor, (task_info_t)&infoData, &task_info_outCnt ); struct dyld_all_image_infos *allImageInfos = (struct dyld_all_image_infos *)infoData.all_image_info_addr; uintptr_t sharedCacheSlide = allImageInfos->sharedCacheSlide; This of course crashes at the last line, when I replace mach_task_self() with: task_for_pid(..., pid,...) because now infoData.all_image_info_addr will be an address not in my address space but in the address space of process "pid". > > Once you've found the address, it's fairly trivial to read from it via the Mach APIs. Could you tell me what function I should use? It sure might be trivial, but I am quite clueless. Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get the slide of another process
by Joseph Ranieri 05 Apr '12

05 Apr '12

On Thu, Apr 5, 2012 at 11:49 AM, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > > On 5 Apr 2012, at 15:31, Quinn The Eskimo! wrote: > >> On 4 Apr 2012, at 12:28, Gerriet M. Denkmann wrote: >> >>> Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the slide of it? >> >> One way to do it--and I'm certainly not sure that this is the best way--is to find dyld and then use the dyld debug interface to find all the images in the process. > > Could you be a bit more specific? > > I don't know how to "find dyld". > Do you mean find a memory region starting at 'a' where proc_regionfilename( pid, a, ... ) gives: "/usr/lib/dyld" ? > > If so, there are typically about half a dozen of those. > > And where (in which header file?) is the "dyld debug interface" documented? > > Sorry for being so clueless. > > > Kind regards, > > Gerriet. Basically you need to find dyld_all_image_infos in the remote process. gdb uses task_info passing in TASK_DYLD_INFO to get the address. lldb also has to find the symbol, but I'm not certain how it does it and couldn't find it quickly in the source code. Once you've found the address, it's fairly trivial to read from it via the Mach APIs. Just keep in mind that you might be inspecting a 32-bit process from a 64-bit process or the other way around. -- Joe Ranieri _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get the slide of another process
by Gerriet M. Denkmann 05 Apr '12

05 Apr '12

On 5 Apr 2012, at 15:31, Quinn The Eskimo! wrote: > On 4 Apr 2012, at 12:28, Gerriet M. Denkmann wrote: > >> Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the slide of it? > > One way to do it--and I'm certainly not sure that this is the best way--is to find dyld and then use the dyld debug interface to find all the images in the process. Could you be a bit more specific? I don't know how to "find dyld". Do you mean find a memory region starting at 'a' where proc_regionfilename( pid, a, ... ) gives: "/usr/lib/dyld" ? If so, there are typically about half a dozen of those. And where (in which header file?) is the "dyld debug interface" documented? Sorry for being so clueless. Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How to get the slide of another process
by Quinn "The Eskimo!" 05 Apr '12

05 Apr '12

On 4 Apr 2012, at 12:28, Gerriet M. Denkmann wrote: > Given a normal app (NOT a kext) (which might run as root if necessary) and the pid of another process, how to I get the slide of it? One way to do it--and I'm certainly not sure that this is the best way--is to find dyld and then use the dyld debug interface to find all the images in the process. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0