Support for High Sierra and Mojave

[iradization]

Hi, I would like to add support for this project to the relevant OS versions.

Perhaps do you know how can I detect the location of the syscall table on those versions while connecting from remote kdp.

thanks
Irad

[phdphuc]

Hi Irad,

For macOS High Sierra, it could be done by referring to these commits. I will investigate macOS Mojave after its official stable release.

There couple of techniques to discover sysent table. Every syscall is executed via INT80, and the interrupt descriptor table (IDT) address is exposed to userspace from kernel space through assembly instruction SIDT (store interrupt descriptor table register). From IDT address, one can calculate the location of INT80 by adding the offset distance since we know the size of IDT descriptor structure, which sized 16 bytes. Thereafter, by dynamically searching backward for the MachO magic value header 0xfeedfacf 64-bit kernel or 0xfeedface 32-bit kernel, we can obtain the base address of the kernel. The systent table is located in DATA segment (til Mac OSX El Capitan) or CONST segment (macOS), hence parsing the LOAD commands from known base kernel header we can find out the segment location. Other techniques are information extraction from userspace /dev/kmem, or using the MSR register number which contains the syscall entrypoint.

Pham.

[iradization]

Hi Pham and thanks for the reply,

regarding High Sierra, I've tried to use 'sidt' opcode to locate IDT, but it looks like Apple block it from 10.13.2 and it seems like the sidt now points to corrupted table structure

I also found another reference for this behavior in the following https://reverse.put.as/2018/01/07/measuring-osx-meltdown-patches-performance/

perhaps did you have a chance to check this method on 10.13.2 or above ?

My intention is hooking some syscalls using kernel module by simply change the appropriate address of the desired syscall entry in table and replace it with address of my own implementation.

So if i'm not limited to 'sidt' because all kernel VM is accessible to me. Do you think that if i take arbitrary function address (i.e. proc_name) and use the same backwards search to reach the syscall table ?

thanks,