search

bazad / memctl

An iOS kernel introspection tool.
https://bazad.github.io/2017/09/live-kernel-introspection-ios/
MIT License
226 stars 29 forks source link

arm32 on iphone 4 #4

Open resistor4u opened 6 years ago

resistor4u commented 6 years ago

the makefile targets and the lib and cores support 64-bit, but is there any advice for adding arm32 support? i have an old jailbroken iphone4 (3,2) on 7.1.2 that i have and want to explore modifying the kernel.

bazad commented 6 years ago

Unfortunately I'm not planning on adding 32-bit support myself because it would be a significant effort and I'd prefer to focus elsewhere (e.g. keeping memctl up-to-date with new iOS releases).

Additionally, I wrote libmemctl assuming that it would be running on iOS 10 or later. libmemctl relies on certain kernel functions and behaviors to work properly. I'm not sure that all of those functions and behaviors are similar enough back in iOS 7.1.2 that it would still work.

If you are looking to add arm32 support to memctl, the most important step is figuring out the best strategies for accomplishing all of the major pieces of functionality:

  1. How do you get the kernel image so that libmemctl can find functions? (I think there are known decryption keys for some devices, but I'm not familiar with this process.)
  2. How do you find the kernel slide given the kernel_task port?
  3. Does the kernel call mechanism still work on iOS 7.1.2? (Here you'll actually have an easier job of it than arm64, since kernel_call_7 will not truncate the return value.)
  4. Once you can call kernel functions, how do you determine whether a memory address is safe to read or write?
  5. You'll need to handle any API changes in kernel functions between iOS 7 and iOS 10.

Unfortunately, there are also some places in the code where I wasn't as platform-agnostic as I could have been. I've tried to minimize this, but you'll still encounter chunks of code that assume a 64-bit platform. These will have to be reworked.

Overall, I suspect it would be a significant undertaking requiring a good amount of research about how iOS 7 and 32-bit XNU work. If you are considering adding 32-bit support yourself, then more power to you; you'll definitely learn a lot. Just keep in mind that it's probably going to be a lot of work.