2018-10-12 16:35:0711957人阅读
LC 00: LC_SEGMENT_64 Mem: 0x000000000-0x100000000 __PAGEZERO LC 01: LC_SEGMENT_64 Mem: 0x100000000-0x101e71000 __TEXT Mem: 0x100002370-0x1000292cf __TEXT.__text (Normal) Mem: 0x1000292d0-0x10002982e __TEXT.__stubs (Symbol Stubs) Mem: 0x100029830-0x10002a132 __TEXT.__stub_helper (Normal) Mem: 0x10002a140-0x10002a690 __TEXT.__const Mem: 0x10002a690-0x10002b914 __TEXT.__objc_methname (C-String Literals) Mem: 0x10002b914-0x10002b9d5 __TEXT.__objc_classname (C-String Literals) Mem: 0x10002b9d5-0x10002beb6 __TEXT.__objc_methtype (C-String Literals) Mem: 0x10002bec0-0x10002e8d5 __TEXT.__cstring (C-String Literals) Mem: 0x10002e8d6-0x10002e92e __TEXT.__ustring Mem: 0x10002e92e-0x10003dc04 __TEXT.__objc_cons1 Mem: 0x10003dc04-0x10029ed87 __TEXT.__objc_cons2 ; Yeee, see this! Mem: 0x10029ed87-0x1002b71a9 __TEXT.__objc_cons3 Mem: 0x1002b71a9-0x100f11a36 __TEXT.__objc_cons4 Mem: 0x100f11a36-0x10160e0ca __TEXT.__objc_cons5 Mem: 0x10160e0ca-0x101dd6e3f __TEXT.__objc_cons6 Mem: 0x101dd6e3f-0x101dd7152 __TEXT.__objc_cons7 Mem: 0x101dd7152-0x101dd7a17 __TEXT.__objc_cons8 Mem: 0x101dd7a17-0x101e45a6e __TEXT.__objc_cons9 Mem: 0x101e45a6e-0x101e57e74 __TEXT.__objc_cons10 Mem: 0x101e57e74-0x101e69288 __TEXT.__objc_cons11 Mem: 0x101e69288-0x101e699e0 __TEXT.__unwind_info Mem: 0x101e699e0-0x101e71000 __TEXT.__eh_frame LC 02: LC_SEGMENT_64 Mem: 0x101e71000-0x101e75000 __DATA Mem: 0x101e71000-0x101e71028 __DATA.__program_vars Mem: 0x101e71028-0x101e710b8 __DATA.__got (Non-Lazy Symbol Ptrs) Mem: 0x101e710b8-0x101e710c8 __DATA.__nl_symbol_ptr (Non-Lazy Symbol Ptrs) Mem: 0x101e710c8-0x101e717f0 __DATA.__la_symbol_ptr (Lazy Symbol Ptrs) Mem: 0x101e717f0-0x101e717f8 __DATA.__mod_init_func (Module Init Function Ptrs) Mem: 0x101e717f8-0x101e71800 __DATA.__mod_term_func (Module Termination Function Ptrs) Mem: 0x101e71800-0x101e71b40 __DATA.__const Mem: 0x101e71b40-0x101e71b60 __DATA.__objc_classlist (Normal) Mem: 0x101e71b60-0x101e71b68 __DATA.__objc_nlclslist (Normal) Mem: 0x101e71b68-0x101e71b78 __DATA.__objc_catlist (Normal) Mem: 0x101e71b78-0x101e71ba0 __DATA.__objc_protolist Mem: 0x101e71ba0-0x101e71ba8 __DATA.__objc_imageinfo Mem: 0x101e71ba8-0x101e72f90 __DATA.__objc_const Mem: 0x101e72f90-0x101e73590 __DATA.__objc_selrefs (Literal Pointers) Mem: 0x101e73590-0x101e735a0 __DATA.__objc_protorefs Mem: 0x101e735a0-0x101e736f8 __DATA.__objc_classrefs (Normal) Mem: 0x101e736f8-0x101e73718 __DATA.__objc_superrefs (Normal) Mem: 0x101e73718-0x101e738a8 __DATA.__objc_data Mem: 0x101e738a8-0x101e73930 __DATA.__objc_ivar Mem: 0x101e73930-0x101e74390 __DATA.__cfstring Mem: 0x101e74390-0x101e746b8 __DATA.__data Mem: 0x101e746c0-0x101e74b60 __DATA.__bss (Zero Fill) Mem: 0x101e74b60-0x101e74b90 __DATA.__common (Zero Fill)LC 03: LC_SEGMENT_64 Mem: 0x101e75000-0x101eba000 __ui0 LC 04: LC_SEGMENT_64 Mem: 0x101eba000-0x101ebf000 __LINKEDIT LC 05: LC_DYLD_INFO LC 06: LC_SYMTAB Symbol table is at offset 0x1ebbc48 (32226376), 293 entries String table is at offset 0x1ebd610 (32232976), 4776 bytes ....
Saigon:~ geosn0w$ /Users/geosn0w/Desktop/ToolChain/jtool/jtool -e __TEXT.__objc_cons2 /Users/geosn0w/Desktop/pangu.app/Contents/MacOS/pangu Requested section found at Offset 252932 Extracting __TEXT.__objc_cons2 at 252932, 2494851 (261183) bytes into pangu.__TEXT.__objc_cons2 Saigon:~ geosn0w$ file /Users/geosn0w/pangu.__TEXT.__objc_cons2 /Users/geosn0w/pangu.__TEXT.__objc_cons2: gzip compressed data, from Unix Saigon:~ geosn0w$ tar tvf /Users/geosn0w/pangu.__TEXT.__objc_cons2 drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/ drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/_CodeSignature/-rwxrwxrwx 0 0 0 3638 Jun 27 2014 Payload/ipa1.app/_CodeSignature/CodeResources-rwxrwxrwx 0 0 0 15112 Jun 27 2014 Payload/ipa1.app/AppIcon60x60@2x.png-rwxrwxrwx 0 0 0 20753 Jun 27 2014 Payload/ipa1.app/AppIcon76x76@2x~ipad.png-rwxrwxrwx 0 0 0 8017 Jun 27 2014 Payload/ipa1.app/AppIcon76x76~ipad.png-rwxrwxrwx 0 0 0 75320 Jun 27 2014 Payload/ipa1.app/Assets.car-rwxrwxrwx 0 0 0 7399 Jun 27 2014 Payload/ipa1.app/embedded.mobileprovision drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/en.lproj/-rwxrwxrwx 0 0 0 74 Jun 27 2014 Payload/ipa1.app/en.lproj/InfoPlist.strings-rwxrwxrwx 0 0 0 1955 Jun 27 2014 Payload/ipa1.app/Info.plist-rwxrwxrwx 0 0 0 312208 Jun 27 2014 Payload/ipa1.app/ipa1-rwxrwxrwx 0 0 0 968 Jun 27 2014 Payload/ipa1.app/ipa1-Info.plist-rwxrwxrwx 0 0 0 235794 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-568h@2x.png-rwxrwxrwx 0 0 0 785321 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Landscape@2x~ipad.png-rwxrwxrwx 0 0 0 261481 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Landscape~ipad.png-rwxrwxrwx 0 0 0 660541 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Portrait@2x~ipad.png-rwxrwxrwx 0 0 0 244644 Jun 27 2014 Payload/ipa1.app/LaunchImage-700-Portrait~ipad.png-rwxrwxrwx 0 0 0 216627 Jun 27 2014 Payload/ipa1.app/LaunchImage-700@2x.png-rwxrwxrwx 0 0 0 8 Jun 27 2014 Payload/ipa1.app/PkgInfo-rwxrwxrwx 0 0 0 150 Jun 27 2014 Payload/ipa1.app/ResourceRules.plist drwxrwxrwx 0 0 0 0 Jun 27 2014 Payload/ipa1.app/zh-Hans.lproj/-rwxrwxrwx 0 0 0 73 Jun 27 2014 Payload/ipa1.app/zh-Hans.lproj/InfoPlist.strings Saigon:~ geosn0w$
UIApplication.shared.open(url, options: [:], completionHandler: nil)
int remountRootFS (void){ ... uint64_t rootVnodeAddr = findKernelSymbol("_rootvnode"); uint64_t *actualVnodeAddr; struct vnode *rootvnode = 0; char *v_mount; status("Attempting to remount rootFS...\n"); readKernelMemory(rootVnodeAddr, sizeof(void *), &actualVnodeAddr); readKernelMemory(*actualVnodeAddr, sizeof(struct vnode), &rootvnode); readKernelMemory(rootvnode->v_mount, 0x100, &v_mount); // Disable MNT_ROOTFS momentarily, remounts , and then flips the flag back uint32_t mountFlags = (*(uint32_t * )(v_mount + 0x70)) & ~(MNT_ROOTFS | MNT_RDONLY); writeKernelMemory(((char *)rootvnode->v_mount) + 0x70 ,sizeof(mountFlags), &mountFlags); char *opts = strdup("/dev/disk0s1s1"); // Not enough to just change the MNT_RDONLY flag - we have to call // mount(2) again, to refresh the kernel code paths for mounting.. int rc = mount("apfs", "/", MNT_UPDATE, (void *)&opts); printf("RC: %d (flags: 0x%x) %s \n", rc, mountFlags, strerror(errno)); mountFlags |= MNT_ROOTFS; writeKernelMemory(((char *)rootvnode->v_mount) + 0x70 ,sizeof(mountFlags), &mountFlags); // Quick test: int fd = open ("/test.txt", O_TRUNC| O_CREAT); if (fd < 0) { error ("Failed to remount /"); } else { status("Mounted / as read write :-)\n"); unlink("/test.txt"); // clean up } return 0;
ioreg -p IODeviceTree -l | grep boot-manifest-hash
char *copyBootHash(void) { unsigned char buf[1024]; uint32_t length = 1024; io_registry_entry_t chosen = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/chosen"); if (!MACH_PORT_VALID(chosen)) { printf("Unable to get IODeviceTree:/chosen port\n"); return NULL; } kern_return_t ret = IORegistryEntryGetProperty(chosen, "boot-manifest-hash", (void*)buf, &length); IOObjectRelease(chosen); if (ret != ERR_SUCCESS) { printf("Unable to read boot-manifest-hash\n"); return NULL; } // Make a hex string out of the hash char manifestHash[length*2+1]; bzero(manifestHash, sizeof(manifestHash)); int i; for (i=0; i<length; i++) { sprintf(manifestHash+i*2, "%02X", buf[i]); } printf("Hash: %s\n", manifestHash); return strdup(manifestHash);}
const char *find_system_snapshot(const char *rootfsmnt) { char *bootHash = copyBootHash(); char *system_snapshot = malloc(sizeof(char *) + (21 + strlen(bootHash))); bzero(system_snapshot, sizeof(char *) + (21 + strlen(bootHash))); if (!bootHash) { return NULL; } sprintf(system_snapshot, "com.apple.os.update-%s", bootHash); printf("System snapshot: %s\n", system_snapshot); return system_snapshot;}
本文翻译自:https://geosn0w.github.io/Jailbreaks-Demystified/. 翻译作者:lucywang
原文地址: http://www.4hou.com/mobile/13960.html