1 files changed, 27 insertions, 27 deletions

diff --git a/main.m b/main.m
index b342996..0afddec 100644
--- a/main.m
+++ b/main.m
@@ -19,15 +19,12 @@
 #include "kc_parameters.h"
 #include "kernel_memory.h"
 
-#define PF(x) SETOFFSET(x, find_ ## x ())
-
 mach_port_t try_restore_port() {
     mach_port_t port = MACH_PORT_NULL;
     kern_return_t err;
 
     err = host_get_special_port(mach_host_self(), 0, 4, &port);
     if (err == KERN_SUCCESS && port != MACH_PORT_NULL) {
-        fprintf(stderr, "got persisted port!\n");
         // make sure rk64 etc use this port
         return port;
     }
@@ -42,48 +39,51 @@ int main(int argc, char* argv[]) {
         return -1;
     }
     mach_port_t tfp0 = try_restore_port();
-    if (tfp0 == MACH_PORT_NULL)
+    if (tfp0 == MACH_PORT_NULL) {
+        fprintf(stderr, "Unable to obtain tfp0\n");
         return -2;
+    }
     set_tfp0(tfp0);
     struct task_dyld_info dyld_info = { 0 };
     mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
     if (task_info(tfp0, TASK_DYLD_INFO, (task_info_t)&dyld_info, &count) != KERN_SUCCESS ||
-        (kernel_base = dyld_info.all_image_info_addr) == 0 ||
-        (kernel_slide = dyld_info.all_image_info_size) == 0) {
+        (kernel_base = dyld_info.all_image_info_addr) == 0) {
         return -3;
     }
-    init_kernel(kread, kernel_base, NULL);
-    uint64_t trust_chain = find_trustcache();
-    PF(trustcache);
-    PF(kernel_task);
-    PF(pmap_load_trust_cache);
+    kernel_slide = dyld_info.all_image_info_size;
+  @autoreleasepool {
+    NSMutableDictionary *offsets = [NSMutableDictionary dictionaryWithContentsOfFile:@"/jb/offsets.plist"];
+    SETOFFSET(trustcache, (uint64_t)strtoull([offsets[@"TrustChain"] UTF8String], NULL, 16));
 #if __arm64e__
-    PF(paciza_pointer__l2tp_domain_module_start);
-    PF(paciza_pointer__l2tp_domain_module_stop);
-    PF(l2tp_domain_inited);
-    PF(sysctl__net_ppp_l2tp);
-    PF(sysctl_unregister_oid);
-    PF(mov_x0_x4__br_x5);
-    PF(mov_x9_x0__br_x1);
-    PF(mov_x10_x3__br_x6);
-    PF(kernel_forge_pacia_gadget);
-    PF(kernel_forge_pacda_gadget);
-#endif
-    PF(IOUserClient__vtable);
-    PF(IORegistryEntry__getRegistryEntryID);
-    term_kernel();
+    SETOFFSET(kernel_task, (uint64_t)strtoull([offsets[@"KernelTask"] UTF8String], NULL, 16));
+    // We should use this on other things but kexecute is broken for i6 at least
+    SETOFFSET(pmap_load_trust_cache, (uint64_t)strtoull([offsets[@"PmapLoadTrustCache"] UTF8String], NULL, 16));
+    if (GETOFFSET(pmap_load_trust_cache)) pmap_load_trust_cache = _pmap_load_trust_cache;
+    SETOFFSET(paciza_pointer__l2tp_domain_module_start, (uint64_t)strtoull([offsets[@"PacizaPointerL2TPDomainModuleStart"] UTF8String], NULL, 16));
+    SETOFFSET(paciza_pointer__l2tp_domain_module_stop, (uint64_t)strtoull([offsets[@"PacizaPointerL2TPDomainModuleStop"] UTF8String], NULL, 16));
+    SETOFFSET(l2tp_domain_inited, (uint64_t)strtoull([offsets[@"L2TPDomainInited"] UTF8String], NULL, 16));
+    SETOFFSET(sysctl__net_ppp_l2tp, (uint64_t)strtoull([offsets[@"SysctlNetPPPL2TP"] UTF8String], NULL, 16));
+    SETOFFSET(sysctl_unregister_oid, (uint64_t)strtoull([offsets[@"SysctlUnregisterOid"] UTF8String], NULL, 16));
+    SETOFFSET(mov_x0_x4__br_x5, (uint64_t)strtoull([offsets[@"MovX0X4BrX5"] UTF8String], NULL, 16));
+    SETOFFSET(mov_x9_x0__br_x1, (uint64_t)strtoull([offsets[@"MovX9X0BrX1"] UTF8String], NULL, 16));
+    SETOFFSET(mov_x10_x3__br_x6, (uint64_t)strtoull([offsets[@"MovX10X3BrX6"] UTF8String], NULL, 16));
+    SETOFFSET(kernel_forge_pacia_gadget, (uint64_t)strtoull([offsets[@"KernelForgePaciaGadget"] UTF8String], NULL, 16));
+    SETOFFSET(kernel_forge_pacda_gadget, (uint64_t)strtoull([offsets[@"KernelForgePacdaGadget"] UTF8String], NULL, 16));
+    SETOFFSET(IOUserClient__vtable, (uint64_t)strtoull([offsets[@"IOUserClientVtable"] UTF8String], NULL, 16));
+    SETOFFSET(IORegistryEntry__getRegistryEntryID, (uint64_t)strtoull([offsets[@"IORegistryEntryGetRegistryEntryID"] UTF8String], NULL, 16));
     parameters_init();
     kernel_task_port = tfp0;
     current_task = rk64(task_self_addr() + OFFSET(ipc_port, ip_kobject));
     kernel_task = rk64(GETOFFSET(kernel_task));
     kernel_call_init();
+#endif
     printf("Injecting to trust cache...\n");
-  @autoreleasepool {
     NSMutableArray *files = [NSMutableArray new];
     for (int i=1; i<argc; i++) {
         [files addObject:@( argv[i] )];
     }
-    int errs = injectTrustCache(files, trust_chain, pmap_load_trust_cache);
+
+    int errs = injectTrustCache(files, GETOFFSET(trustcache), pmap_load_trust_cache);
     if (errs < 0) {
         printf("Error %d injecting to trust cache.\n", errs);
     } else {