1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
/*
* inject.m
*
* Created by Sam Bingner on 9/27/2018
* Copyright 2018 Sam Bingner. All Rights Reserved.
*
*/
#include <CoreFoundation/CoreFoundation.h>
#include <mach/mach.h>
#include <dlfcn.h>
#include "patchfinder64/patchfinder64.h"
#include "CSCommon.h"
#include "kern_funcs.h"
#include "inject.h"
mach_port_t try_restore_port() {
mach_port_t port = MACH_PORT_NULL;
kern_return_t err;
err = host_get_special_port(mach_host_self(), 0, 4, &port);
if (err == KERN_SUCCESS && port != MACH_PORT_NULL) {
fprintf(stderr, "got persisted port!\n");
// make sure rk64 etc use this port
return port;
}
fprintf(stderr, "unable to retrieve persisted port\n");
return MACH_PORT_NULL;
}
int main(int argc, char* argv[]) {
if (argc < 2) {
fprintf(stderr,"Usage: inject /full/path/to/executable\n");
fprintf(stderr,"Inject executables to trust cache\n");
return -1;
}
mach_port_t tfp0 = try_restore_port();
if (tfp0 == MACH_PORT_NULL)
return -2;
set_tfp0(tfp0);
uint64_t kernel_base = 0;
struct task_dyld_info dyld_info = { 0 };
mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
if (task_info(tfp0, TASK_DYLD_INFO, (task_info_t)&dyld_info, &count) != KERN_SUCCESS ||
(kernel_base = dyld_info.all_image_info_addr) == 0) {
return -3;
}
init_kernel(kread, kernel_base, NULL);
uint64_t trust_chain = find_trustcache();
term_kernel();
printf("Injecting to trust cache...\n");
@autoreleasepool {
NSMutableArray *files = [NSMutableArray new];
for (int i=1; i<argc; i++) {
[files addObject:@( argv[i] )];
}
int errs = injectTrustCache(files, trust_chain);
if (errs < 0) {
printf("Error %d injecting to trust cache.\n", errs);
} else {
printf("Successfully injected [%d/%d] to trust cache.\n", (int)files.count - errs, (int)files.count);
}
return errs;
}
}
|
