search

checkra1n / BugTracker

checkra1n bug tracker
719 stars 108 forks source link

`task_info` routine not returning kernel slide to usermode #2399

Open g0x69lbo opened 3 days ago

g0x69lbo commented 3 days ago

I'm working on 17.5.1, jailbreak works its just that the task_info mig routine does not return the kernel slide.. I've done some searching and this was already brought up in the past (#1852, #1124, #1070) Also I've tried to search for reference to locate the logic that writes that information to the kernel_task, but didn't find it (I might be missing ..?) I can see the patches that enable tfp0 and in kpf_ramdisk_bootprep I can see that you write the slide just after the ramdisk (I guess this is where XNU reads the bootargs struct from?) but no where is the logic to write to these fields of the kernel task

Please enlighten me 😄

g0x69lbo commented 19 hours ago

For some reason I thought the whole project was released as opensource, now I understand that it is not fully open source, therefore it makes sense that this logic exists in the binary but broke in newer versions.

I'd be happy to support you coming up with support for newer versions if you don't have the time, but that wouldn't be possible if that logic is indeed not open source.

I will modify KPF module for now and will piggyback some unused syscall