@@ -21,30 +21,39 @@ seg_command_64_t *find_segment_64(mach_header_64_t *mh, const char *segname);
2121load_command_t * find_load_command (mach_header_64_t * mh , uint32_t cmd );
2222void * find_symbol (mach_header_64_t * mh , const char * name );
2323
24- void * lookup_symbol (const char * symbol )
25- {
24+ static uint64_t mh_base_addr = 0 ;
25+
26+ void find_mach_header_addr (uint8_t kc ){
2627 uint64_t slide = 0 ;
2728 vm_offset_t slide_address = 0 ;
2829 vm_kernel_unslide_or_perm_external ((unsigned long long )(void * )printf , & slide_address );
2930 slide = (uint64_t )(void * )printf - slide_address ;
3031 uint64_t base_address = (uint64_t )slide + KERNEL_BASE ;
3132
33+ if (!kc ){
34+ mh_base_addr = base_address ;
35+ return ;
36+ }
37+
3238 mach_header_64_t * mach_header = (mach_header_64_t * )base_address ;
33- mach_header_64_t * actual_header = NULL ;
3439
3540 load_command_t * lcp = (load_command_t * )(base_address + sizeof (mach_header_64_t ));
3641 for (uint32_t i = 0 ; i < mach_header -> ncmds ; i ++ ) {
3742 if (lcp -> cmd == LC_SEGMENT_64 ) {
3843 seg_command_64_t * sc = (seg_command_64_t * )lcp ;
3944 if (!strncmp (sc -> segname , "__PRELINK_TEXT" , sizeof (sc -> segname ))) {
40- actual_header = ( mach_header_64_t * ) sc -> vmaddr ;
45+ mh_base_addr = sc -> vmaddr ;
4146 break ;
4247 }
4348 }
4449 lcp = (load_command_t * )((uint64_t )lcp + (uint64_t )lcp -> cmdsize );
4550 }
51+ }
4652
53+ void * lookup_symbol (const char * symbol )
54+ {
4755
56+ if (!mh_base_addr ) return NULL ;
4857// IOLog("%s: aslr slide: 0x%0llx\n", __func__, slide);
4958// print_pointer((void*)slide);
5059// IOLog("%s: base address: 0x%0llx\n", __func__, base_address);
@@ -53,7 +62,7 @@ void *lookup_symbol(const char *symbol)
5362// IOLog("%s: actual address: 0x%0llx\n", __func__, (uint64_t)actual_header);
5463// print_pointer((void*)actual_header);
5564
56- return find_symbol (actual_header , symbol );
65+ return find_symbol (( mach_header_64_t * ) mh_base_addr , symbol );
5766}
5867
5968seg_command_64_t *
0 commit comments