Closed kernel-dev closed 1 year ago
Might be good idea to split PR into 2 parts One for rosetta detection and one for elevation.
If you prefer that, then I can create two separate branches, yes. 👍
Closing this PR in favor of modularizing the specifics of the two main features implemented into their respective PRs: Apple ARM64 detection and elevation fix.
Given target.c:
#include <stdio.h>
#include <unistd.h>
extern int answer(void);
int main(int argc, char* argv[]) {
printf("Hook me: %u %lld\n", (unsigned)getpid(), (long long)(void*)&answer);
while (answer() != 42) {
sleep(1);
}
puts("Won!");
}
int answer(void) {
return 69;
}
First compile for intel macos without optimizations to prevent inline optimizations:
cc -target x86_64-apple-macos -O0 target.c -o target.bin
And injector.c:
#include <stdlib.h>
#include <libproc.h>
#include <mach/mach.h>
#include <mach/mach_traps.h>
#include <mach/mach_vm.h>
#include <unistd.h>
char shellcode[5] = { 0xb8, 0x2a, 0x00, 0x00, 0x00, 0xc3 }; // mov eax,0x2a ; ret
int main(int argc, char** argv) {
int pid = atoi(argv[1]);
mach_vm_address_t address = atoll(argv[2]);
mach_port_t task = {};
task_for_pid(mach_task_self(), pid, &task)
mach_vm_protect(task, address, sizeof(shellcode), 0, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE | VM_PROT_COPY);
mach_vm_write(task, address, (vm_offset_t)shellcode, sizeof(shellcode));
mach_vm_protect(task, address, sizeof(shellcode), 0, VM_PROT_READ | VM_PROT_EXECUTE);
}
Injector can be compiled for either intel or arm.
Running injector (as sudo) on target should succefully patch answer
func such that it returns 42.
Now make it work on rosetta.
Before, users would have to manually run the binary contained inside of the app bundle with
sudo
.This PR proposes a workaround method for this, where the user is explicitly asked for permission where they enter their root password in order to relaunch the application with root privileges.
Alongside that, it also refuses to initialize the application if it detects that it's running under a Rosetta 1/2 translation layer (in other words, if it's on Apple ARM64 Mac machines).