Fix kexecute on iOS 13

jakeajames · Mar 19, 2020 · 800a281 · 800a281
1 parent 95213b4
commit 800a281
Show file tree

Hide file tree

Showing 8 changed files with 6 additions and 2,929 deletions.
diff --git a/include/IOKit/IOKitLib.c b/include/IOKit/IOKitLib.c
diff --git a/include/IOKit/Readme.md b/include/IOKit/Readme.md
diff --git a/include/IOKit/screenshot.jpg b/include/IOKit/screenshot.jpg
diff --git a/jelbrekLib.h b/jelbrekLib.h
diff --git a/kexecute.c b/kexecute.c
@@ -94,7 +94,7 @@ void init_Kernel_Execute(void) {
     // Now the userclient port we have will look into our fake user client rather than the old one
 
     // Replace IOUserClient::getExternalTrapForIndex with our ROP gadget (add x0, x0, #0x40; ret;)
-    KernelWrite_64bits(FakeVtable+8*0xB7, Find_add_x0_x0_0x40_ret());
+    KernelWrite_64bits(FakeVtable+8*off_getExternelTrapForIndex, Find_add_x0_x0_0x40_ret());
 
     //
     //printf("Wrote the `add x0, x0, #0x40; ret;` gadget over getExternalTrapForIndex");

diff --git a/offsetof.c b/offsetof.c
@@ -61,3 +61,4 @@ unsigned off_specflags = 0x10;
 unsigned off_mnt_flag = 0x70;            // mount::mnt_flag
 unsigned off_mnt_data = 0x8f8;           // mount::mnt_data
 
+unsigned off_getExternelTrapForIndex = 0xb7; // IOUserClient::getExternalTrapForIndex
diff --git a/offsetof.h b/offsetof.h
@@ -61,6 +61,8 @@ extern unsigned off_specflags;
 extern unsigned off_mnt_flag;
 extern unsigned off_mnt_data;
 
+extern unsigned off_getExternelTrapForIndex;
+
 #define	CS_VALID		0x0000001	/* dynamically valid */
 #define CS_ADHOC		0x0000002	/* ad hoc signed */
 #define CS_GET_TASK_ALLOW	0x0000004	/* has get-task-allow entitlement */

diff --git a/offsets.m b/offsets.m
@@ -220,6 +220,8 @@ void _offsets_init() {
 #else
         off_t_flags = 0x3d0;
 #endif
+
+        off_getExternelTrapForIndex = 0xb8;
     }
     else if (SYSTEM_VERSION_GREATER_THAN_OR_EQUAL_TO(@"12.0")) {
         printf("[i] offsets selected for iOS 12.0 or above\n");
Original file line number	Diff line number	Diff line change
Expand Up		@@ -61,3 +61,4 @@ unsigned off_specflags = 0x10;
		unsigned off_mnt_flag = 0x70; // mount::mnt_flag
		unsigned off_mnt_data = 0x8f8; // mount::mnt_data

		unsigned off_getExternelTrapForIndex = 0xb7; // IOUserClient::getExternalTrapForIndex