search

SilverMoonSecurity / PassiveFuzzFrameworkOSX

This framework is for fuzzing OSX kernel vulnerability based on passive inline hook mechanism in kernel mode.
227 stars 66 forks source link

Thread safe for in line hook #1

Open ZMer2019 opened 5 years ago

ZMer2019 commented 5 years ago

code:

disable_interrupts();
disable_wp();
memcpy((void*)patch_addr, trampoline, sizeof(trampoline));
enable_wp();
enbale_interrupts();

Actually,"trampoline" generally destroys multiple instructions, in SMP system, how to make theses code thread safe?

keenjoy95 commented 5 years ago

It seems that you are really curious about this issue... ;) (https://github.com/didi/kemon/issues/2)

Let me answer this question for @SilverMoonSecurity / Yuefeng, here is the solution: https://developer.apple.com/library/archive/releasenotes/Performance/RN-AffinityAPI/#//apple_ref/doc/uid/TP40006635-CH1-DontLinkElementID_2

An application that wants to place a thread on every available processor would do the following:

  1. Obtain the number of processors on the system using sysctl(3) (see below).
  2. Create that number of threads.
  3. Set each thread with a distinct affinity tag.
  4. Start all threads.

By using the above method, you can have one thread complete the inline hook operation and the rest start to spin.