update sbops patchfinder

Author: LukeZGD

ios8-jailbreak/daibutsu/jailbreak.c

@@ -216,7 +216,7 @@ void unjail8(void){
     print_log("[*] sandbox\n");
     kwrite32_exec(sandbox_call_i_can_has_debugger, 0xbf00bf00);
 
-    uint32_t sbopsoffset = kbase + find_sbops(kbase, kdata, ksize);
+    uint32_t sbopsoffset = kbase + find_sandbox_mac_policy_ops(kbase, kdata, ksize);
 
     print_log("nuking sandbox\n");
     kwrite32_exec(sbopsoffset + offsetof(struct mac_policy_ops, mpo_vnode_check_ioctl), 0);
@@ -377,7 +377,7 @@ void unjail9(void){
     print_log("[*] sandbox\n");
     kwrite32_exec(sandbox_call_i_can_has_debugger, 0xbf00bf00);
 
-    uint32_t sbopsoffset = kbase + find_sbops(kbase, kdata, ksize);
+    uint32_t sbopsoffset = kbase + find_sandbox_mac_policy_ops(kbase, kdata, ksize);
 
     print_log("nuking sandbox\n");
     kwrite32_exec(sbopsoffset + offsetof(struct mac_policy_ops, mpo_vnode_check_rename), 0);

ios8-jailbreak/daibutsu/patchfinder.c

@@ -2213,17 +2213,21 @@ uint32_t find_lwvm_jump(uint32_t region, uint8_t* kdata, size_t ksize)
     return ((uintptr_t)insn) + 0 - ((uintptr_t)kdata) + 1;
 }
 
-uint32_t find_sbops(uint32_t region, uint8_t* kdata, size_t ksize) {
-    char* seatbelt_sandbox_policy = memmem(kdata, ksize, "Seatbelt sandbox policy", strlen("Seatbelt sandbox policy"));
-    if (!seatbelt_sandbox_policy)
+// from powdersn0w
+uint32_t find_sandbox_mac_policy_ops(uint32_t region, uint8_t* kdata, size_t ksize) {
+    uint8_t* sbStr = memmem(kdata, ksize, "Seatbelt sandbox policy", sizeof("Seatbelt sandbox policy"));
+    if(!sbStr)
         return 0;
+    uint32_t fullname = (uint32_t)sbStr - (uintptr_t)kdata;
 
-    uint32_t seatbelt = (uintptr_t)seatbelt_sandbox_policy - (uintptr_t)kdata + region;
-    char* seatbelt_sandbox_policy_ptr = memmem(kdata, ksize, (char*)&seatbelt, sizeof(seatbelt));
-    if (!seatbelt_sandbox_policy_ptr)
-        return 0;
+    uint32_t search[1];
+    search[0] = fullname+region;
 
-    uint32_t ptr_to_seatbelt = (uintptr_t)seatbelt_sandbox_policy_ptr - (uintptr_t)kdata;
-    uint32_t sbops = ptr_to_seatbelt + 0x24;
-    return sbops;
+    uint8_t* findPtr = memmem(kdata, ksize, &search, 4);
+    if(!findPtr)
+        return 0;
+    uint32_t mpc_top = (uint32_t)findPtr - (uintptr_t)kdata - 4;
+    uint32_t ops_off = mpc_top += 0x10;
+    uint32_t ops = *(uint32_t*)(kdata + ops_off) - region;
+    return ops;
 }

ios8-jailbreak/daibutsu/patchfinder.h

@@ -119,6 +119,6 @@ uint32_t find_amfi_file_check_mmap(uint32_t region, uint8_t* kdata, size_t ksize
 uint32_t find_PE_i_can_has_kernel_configuration_got(uint32_t region, uint8_t* kdata, size_t ksize);
 uint32_t find_lwvm_jump(uint32_t region, uint8_t* kdata, size_t ksize);
 
-uint32_t find_sbops(uint32_t region, uint8_t* kdata, size_t ksize);
+uint32_t find_sandbox_mac_policy_ops(uint32_t region, uint8_t* kdata, size_t ksize);
 
 #endif