Skip to content

Commit

Permalink
Further flesh out sysctl children resolution
Browse files Browse the repository at this point in the history
  • Loading branch information
royalgraphx committed Dec 1, 2024
1 parent 49a95f2 commit f54a7d9
Show file tree
Hide file tree
Showing 2 changed files with 48 additions and 2 deletions.
45 changes: 43 additions & 2 deletions VMHide/kern_start.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,50 @@ static VMH vmhInstance;

VMH *VMH::callbackVMH;

// gets sysctl__children memory address and returns it
mach_vm_address_t sysctlChildrenAddr(KernelPatcher &patcher) {

// resolve the _sysctl__children symbol with the given patcher
mach_vm_address_t sysctlChildrenAddress = patcher.solveSymbol(KernelPatcher::KernelID, "_sysctl__children");

// check if the address was successfully resolved, else return 0
if (sysctlChildrenAddress) {
DBGLOG(MODULE_SYSCTL, "Resolved _sysctl__children at address: 0x%llx", sysctlChildrenAddress);

// cast the address to sysctl_oid_list*
sysctl_oid_list *sysctlChildren = reinterpret_cast<sysctl_oid_list *>(sysctlChildrenAddress);

// log the address for debugging
DBGLOG(MODULE_SYSCTL, "Sysctl children list at address: 0x%llx", reinterpret_cast<mach_vm_address_t>(sysctlChildren));

// iterate over the sysctl_oid_list
sysctl_oid *oid;
SLIST_FOREACH(oid, sysctlChildren, oid_link) {
// log each OID's name and number
DBGLOG(MODULE_SYSCTL, "OID Name: %s, OID Number: %d", oid->oid_name, oid->oid_number);
}

return sysctlChildrenAddress;
} else {
KernelPatcher::Error err = patcher.getError();
SYSLOG(MODULE_SYSCTL, "Failed to resolve _sysctl__children. (Lilu returned: %d)", err);
patcher.clearError();
return 0;
}

}

// Function to solve the _sysctl__children symbol address
static void solveSysCtlChildrenAddr(void *user __unused, KernelPatcher &Patcher) {

DBGLOG(MODULE_SYSCTL, "solveSysCtlChildrenAddr called");
// Log area
DBGLOG(MODULE_SYSCTL, "solveSysCtlChildrenAddr called after Patcher loaded successfully.");

// Get the address of _sysctl__children here
mach_vm_address_t sysCtlChildrenAddress = sysctlChildrenAddr(Patcher);

// Log area
DBGLOG(MODULE_SYSCTL, "mach_vm_address_t of sysCtlChildrenAddress is: 0x%llx", sysCtlChildrenAddress);

}

Expand All @@ -26,7 +66,8 @@ void VMH::init() {
DBGLOG(MODULE_INIT, "Hello World from VMHide!");

// Register the root function to solve _sysctl__children on patcher load
lilu.onPatcherLoad(solveSysCtlChildrenAddr);
DBGLOG(MODULE_INIT, "Attempting to onPatcherLoadForce...");
lilu.onPatcherLoadForce(solveSysCtlChildrenAddr);

}

Expand Down
5 changes: 5 additions & 0 deletions VMHide/kern_start.hpp
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,11 @@ class VMH {
*/
static void solveSysCtlChildrenAddr(void *user __unused, KernelPatcher &Patcher);

/**
* Returns address for the sysctl children symbol
*/
mach_vm_address_t sysctlChildrenAddr(KernelPatcher &patcher);

/**
* Function to reroute kern hv vmm present function to our own custom one in VMH
*/
Expand Down

0 comments on commit f54a7d9

Please sign in to comment.