search

SerotoninApp / Serotonin

641 stars 74 forks source link

Patchfinder does not set correct values for fileglob__fg_ops and proc__p_fd__fd_ofiles #39

Open anthonyjr2 opened 10 months ago

anthonyjr2 commented 10 months ago

Not sure if this was fixed in the port to iOS but there was a bug where these two offsets are output incorrectly using libpatchfinder. These are the correct values they should have (for A12 iPads at least, not sure if it is different for anything else). This fixed kernel panics with landa on both of my devices.

fileglobfg_ops 0x0 -> 0x28 proc__p_fdfd_ofiles 0x0 -> 0xf8

jonahnm commented 10 months ago

this lines up for where I found the issue to be (last thing in stack trace before error) https://github.com/mineek/Serotonin/blob/ddeff5a4ec97e4aca2dd4e46ab7f6135fa9afb65/usprebooter/libkfd/krkw.h#L151

jonahnm commented 10 months ago

No wait I take it back, the error is happening in "objc_autoreleasePoolPop". With error "(Data Abort) byte read Translation fault".

mineek commented 10 months ago

The patchfinder isn't even supposed to find these values, they're still hardcoded in dynamic_info.h. The patchfinder only finds per-kernelcache addresses... And from checking it those values are already there, what iOS version exactly?

anthonyjr2 commented 10 months ago

Ah, I didn't know you were still using dynamic_info.h with the patchfinder. This is for iOS 16.2 on iPad8,3.

EDIT: Just noticed how the dynamic_info is setup different now. Not sure what the issue would be but I do have the offsets on hand that worked successfully on PureKFD

EDIT2: Only thing I see different in my offsets is: .uthread__object_size = 0xfffffffffffffb58, ._vm_map__object_size = 0x0,

Not sure if that's related to it panicking.

jonahnm commented 10 months ago

heya! try the new PR!