-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Workaround for thread_set_state limitation, requires disabling AMFI. F…
- Loading branch information
Showing
9 changed files
with
175 additions
and
56 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| #import <Foundation/Foundation.h> | ||
| #import "injectd_client/MIPProtocol.h" | ||
| #import "inject/inject.h" | ||
|
|
||
| @interface MIPConnection : NSObject <MIPProtocol> | ||
| @end | ||
|
|
||
| @implementation MIPConnection | ||
|
|
||
| - (void)injectDylib:(const char *)dylib toPID:(pid_t)pid interruptSyscalls:(bool)interrupt withReply:(void (^)(NSString *error))reply | ||
| { | ||
| kern_return_t ret = KERN_SUCCESS; | ||
| mach_port_t task = 0; | ||
|
|
||
| if ((ret = task_for_pid(mach_task_self(), pid, &task))) { | ||
| reply(@"Failed to obtain task for PID."); | ||
| return; | ||
| } | ||
|
|
||
| ret = inject_to_task(task, dylib); | ||
| if (ret) { | ||
| reply(@"Injection failed, check Console for details."); | ||
| return; | ||
| } | ||
|
|
||
| if (!interrupt) { | ||
| reply(nil); | ||
| return; | ||
| } | ||
|
|
||
| /* This interrupts blocking system calls to ensure execution. */ | ||
| mach_port_t thread; | ||
|
|
||
| ret = get_thread_port_for_task(task, &thread); | ||
| if (!ret) { | ||
| ret = thread_abort(thread); | ||
| } | ||
| if (ret) { | ||
| reply(@"Injection succeeded, but the injected library will only run after the main thread wakes up."); | ||
| return; | ||
| } | ||
|
|
||
| reply(nil); | ||
| } | ||
|
|
||
| @end | ||
|
|
||
| @interface ServiceDelegate : NSObject <NSXPCListenerDelegate> | ||
| @end | ||
|
|
||
| @implementation ServiceDelegate | ||
|
|
||
| - (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection | ||
| { | ||
| if (newConnection.effectiveUserIdentifier != 0) { | ||
| [newConnection invalidate]; | ||
| return false; | ||
| } | ||
|
|
||
| newConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MIPProtocol)]; | ||
| MIPConnection *exportedObject = [[MIPConnection alloc] init]; | ||
| newConnection.exportedObject = exportedObject; | ||
|
|
||
| [newConnection resume]; | ||
| return true; | ||
| } | ||
|
|
||
| @end | ||
|
|
||
| int main(int argc, const char *argv[]) | ||
| { | ||
| ServiceDelegate *delegate = [ServiceDelegate new]; | ||
|
|
||
| NSXPCListener *listener = [[NSXPCListener alloc] initWithMachServiceName:@"local.injectd"]; | ||
| listener.delegate = delegate; | ||
|
|
||
| [listener resume]; | ||
| [[NSRunLoop mainRunLoop] run]; | ||
| return 0; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| #import <Foundation/Foundation.h> | ||
|
|
||
| @protocol MIPProtocol | ||
| - (void)injectDylib:(const char *)dylib toPID:(pid_t)pid interruptSyscalls:(bool)interrupt withReply:(void (^)(NSString *error))reply; | ||
| @end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| #include <stdbool.h> | ||
| #include <sys/types.h> | ||
|
|
||
| const char *inject_to_pid(pid_t pid, const char *dylib, bool interrupt_syscalls); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| #import <Foundation/Foundation.h> | ||
| #import <pthread.h> | ||
| #import "MIPProtocol.h" | ||
|
|
||
| const char *inject_to_pid(pid_t pid, const char *dylib, bool interrupt_syscalls) | ||
| { | ||
| __block NSString *ret = @"Could not connect to injectd"; | ||
|
|
||
| @autoreleasepool { | ||
| static id<MIPProtocol> remoteObject = nil; | ||
| static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; | ||
|
|
||
|
|
||
| __block bool shouldRetry = false; | ||
| __block bool didRetry = false; | ||
|
|
||
| retry: | ||
| pthread_mutex_lock(&lock); | ||
| if (!remoteObject) { | ||
| static NSXPCConnection *connection = nil; | ||
| if (connection) { | ||
| [connection invalidate]; | ||
| connection = nil; | ||
| } | ||
|
|
||
| connection = [[NSXPCConnection alloc] initWithMachServiceName:@"local.injectd" options:0]; | ||
| connection.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MIPProtocol)]; | ||
| [connection resume]; | ||
|
|
||
| remoteObject = [connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) { | ||
| NSLog(@"injectd connection error: %@", error.localizedDescription); | ||
| ret = error.localizedDescription; | ||
| if (!didRetry) { | ||
| shouldRetry = true; | ||
| } | ||
| }]; | ||
| } | ||
|
|
||
| [remoteObject injectDylib:dylib toPID:pid interruptSyscalls:interrupt_syscalls withReply:^(NSString *reply) { | ||
| ret = reply; | ||
| }]; | ||
|
|
||
| pthread_mutex_unlock(&lock); | ||
|
|
||
| if (shouldRetry) { | ||
| shouldRetry = false; | ||
| didRetry = true; | ||
| remoteObject = nil; | ||
| goto retry; | ||
| } | ||
| } | ||
|
|
||
| return ret.UTF8String; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.