1""" 2Wrappers around globals and caches to service the kmem package 3""" 4from abc import ABCMeta, abstractmethod 5from collections import namedtuple 6from core import ( 7 caching, 8 gettype, 9 lldbwrap, 10) 11from ctypes import c_int64 12 13class MemoryRange(namedtuple('MemoryRange', ['start', 'end'])): 14 @property 15 def size(self): 16 start, end = self 17 return end - start 18 19 def contains(self, addr): 20 start, end = self 21 return start <= addr < end 22 23 def __repr__(self): 24 return "{0.__class__.__name__}[{0.start:#x}, {0.end:#x})".format(self) 25 26 27class VMPointerUnpacker(object): 28 """ 29 Pointer unpacker for pointers packed with VM_PACK_POINTER() 30 """ 31 def __init__(self, target, param_var): 32 params = target.chkFindFirstGlobalVariable(param_var) 33 self.base_relative = params.xGetScalarByName('vmpp_base_relative') 34 self.bits = params.xGetScalarByName('vmpp_bits') 35 self.shift = params.xGetScalarByName('vmpp_shift') 36 self.base = params.xGetScalarByName('vmpp_base') 37 38 def unpack(self, packed): 39 """ 40 Unpacks an address according to the VM_PACK_POINTER() scheme 41 42 @param packed (int) 43 The packed value to unpack 44 45 @returns (int) 46 The unpacked address 47 """ 48 49 if not packed: 50 return None 51 52 if self.base_relative: 53 addr = (packed << self.shift) + self.base 54 else: 55 bits = self.bits 56 shift = self.shift 57 addr = c_int64(packed << (64 - bits)).value 58 addr >>= 64 - bits - shift 59 60 return addr & 0xffffffffffffffff 61 62 def unpack_value(self, sbv): 63 """ 64 Conveniency wrapper for self.unpack(sbv.chkGetValueAsUnsigned()) 65 """ 66 return self.unpack(sbv.chkGetValueAsUnsigned()) 67 68 69class KMem(object, metaclass=ABCMeta): 70 """ 71 Singleton class that holds various important information 72 that is needed to make sense of the kernel memory layout, 73 heap data structures, globals, ... 74 """ 75 76 _HEAP_NAMES = [ "", "shared.", "data.", "" ] 77 78 @staticmethod 79 def _parse_range(zone_info_v, name): 80 """ 81 Create a tuple representing a range (min_address, max_address, size) 82 """ 83 range_v = zone_info_v.chkGetChildMemberWithName(name) 84 left = range_v.xGetIntegerByName('min_address') 85 right = range_v.xGetIntegerByName('max_address') 86 return MemoryRange(left, right) 87 88 def __init__(self, target): 89 self.target = target 90 91 # 92 # Cache some globals everyone needs 93 # 94 self.page_shift = target.chkFindFirstGlobalVariable('page_shift').xGetValueAsInteger() 95 self.page_size = 1 << self.page_shift 96 self.page_mask = self.page_size - 1 97 98 phase_v = target.chkFindFirstGlobalVariable('startup_phase') 99 self.phase = phase_v.xGetValueAsInteger() 100 self.phases = set( 101 e.GetName()[len('STARTUP_SUB_'):] 102 for e in phase_v.GetType().get_enum_members_array() 103 if e.GetValueAsUnsigned() <= self.phase 104 ) 105 106 # 107 # Setup the number of CPUs we have 108 # 109 self.ncpus = target.chkFindFirstGlobalVariable('zpercpu_early_count').xGetValueAsInteger() 110 self.master_cpu = target.chkFindFirstGlobalVariable('master_cpu').xGetValueAsInteger() 111 self.zcpus = range(self.ncpus) if 'ZALLOC' in self.phases else (self.master_cpu, ) 112 self.pcpus = range(self.ncpus) if 'PERCPU' in self.phases else (self.master_cpu, ) 113 114 # 115 # Load all the ranges we will need 116 # 117 zone_info = target.chkFindFirstGlobalVariable('zone_info') 118 self.meta_range = self._parse_range(zone_info, 'zi_meta_range') 119 self.bits_range = self._parse_range(zone_info, 'zi_bits_range') 120 self.zone_range = self._parse_range(zone_info, 'zi_map_range') 121 try: 122 self.pgz_range = self._parse_range(zone_info, 'zi_pgz_range') 123 self.pgz_bt = target.chkFindFirstGlobalVariable('pgz_backtraces').xDereference() 124 except: 125 self.pgz_range = MemoryRange(0, 0) 126 self.pgz_bt = None 127 128 kmem_ranges = target.chkFindFirstGlobalVariable('kmem_ranges') 129 count = kmem_ranges.GetByteSize() // target.GetAddressByteSize() 130 addresses = target.xIterAsUInt64(kmem_ranges.GetLoadAddress(), count) 131 self.kmem_ranges = [ 132 MemoryRange(next(addresses), next(addresses)) 133 for i in range(0, count, 2) 134 ] 135 136 kmem_ranges = target.chkFindFirstGlobalVariable('gIOKitPageableFixedRanges') 137 count = kmem_ranges.GetByteSize() // target.GetAddressByteSize() 138 addresses = target.xIterAsUInt64(kmem_ranges.GetLoadAddress(), count) 139 self.iokit_ranges = [ 140 MemoryRange(next(addresses), next(addresses)) 141 for i in range(0, count, 2) 142 ] 143 144 # 145 # And other important globals 146 # 147 self.stext = target.chkFindFirstGlobalVariable('vm_kernel_stext').xGetValueAsInteger() 148 self.num_zones = target.chkFindFirstGlobalVariable('num_zones').xGetValueAsInteger() 149 self.mag_size = target.chkFindFirstGlobalVariable('_zc_mag_size').xGetValueAsInteger() 150 self.zone_array = target.chkFindFirstGlobalVariable('zone_array') 151 self.zsec_array = target.chkFindFirstGlobalVariable('zone_security_array') 152 153 self.kernel_map = target.chkFindFirstGlobalVariable('kernel_map').Dereference() 154 self.vm_kobject = target.chkFindFirstGlobalVariable('kernel_object_store') 155 156 # 157 # Cache some crucial types used for memory walks 158 # 159 self.zpm_type = gettype('struct zone_page_metadata') 160 self.vm_map_type = gettype('struct _vm_map') 161 self.vmo_type = self.vm_kobject.GetType() 162 163 # 164 # Recognize whether the target is any form of KASAN kernel. 165 # 166 if any(target.FindFirstGlobalVariable('kasan_enabled')): 167 self.kasan = True 168 self.kasan_tbi = any(target.FindFirstGlobalVariable('kasan_tbi_enabled')) 169 self.kasan_classic = not self.kasan_tbi 170 else: 171 self.kasan = False 172 self.kasan_tbi = False 173 self.kasan_classic = False 174 175 # 176 # VM_PACK_POINTER Unpackers 177 # 178 self.kn_kq_packing = VMPointerUnpacker(target, 'kn_kq_packing_params') 179 self.vm_page_packing = VMPointerUnpacker(target, 'vm_page_packing_params') 180 self.rwlde_caller_packing = VMPointerUnpacker(target, 'rwlde_caller_packing_params') 181 self.c_slot_packing = VMPointerUnpacker(target, 'c_slot_packing_params') 182 183 @staticmethod 184 @caching.cache_statically 185 def get_shared(target=None): 186 """ 187 Returns a shared instance of the class 188 """ 189 190 arch = target.triple[:target.triple.find('-')] 191 192 if arch.startswith('arm64e'): 193 return _KMemARM64e(target) 194 elif arch.startswith('arm64'): 195 return _KMemARM64(target) 196 elif arch.startswith('x86_64'): 197 return _KMemX86(target) 198 else: 199 raise RuntimeError("Unsupported architecture: {}".format(arch)) 200 201 def iter_addresses(self, iterable): 202 """ 203 Conveniency wrapper to transform a list of integer to addresses 204 """ 205 return (self.make_address(a) for a in iterable) 206 207 # 208 # Abstract per-arch methods 209 # 210 211 @property 212 @abstractmethod 213 def has_ptrauth(self): 214 """ whether this target has ptrauth """ 215 216 pass 217 218 @abstractmethod 219 def PERCPU_BASE(self, cpu): 220 """ 221 Returns the per-cpu base for a given CPU number 222 223 @param cpu (int) 224 A CPU number 225 226 @returns (int) 227 The percpu base for this CPU 228 """ 229 230 pass 231 232 @abstractmethod 233 def make_address(self, addr): 234 """ 235 Make an address out of an integer 236 237 @param addr (int) 238 An address to convert 239 240 @returns (int) 241 """ 242 243 pass 244 245 246class _KMemARM64(KMem): 247 """ 248 Specialization of KMem for arm64 249 """ 250 251 def __init__(self, target): 252 super().__init__(target) 253 254 self.arm64_CpuDataEntries = target.chkFindFirstGlobalVariable('CpuDataEntries') 255 self.arm64_BootCpuData = target.chkFindFirstGlobalVariable('percpu_slot_cpu_data') 256 self.arm64_t1sz = target.chkFindFirstGlobalVariable('gT1Sz').xGetValueAsInteger() 257 self.arm64_sign_mask = 1 << (63 - self.arm64_t1sz) 258 259 @property 260 def has_ptrauth(self): 261 return False 262 263 def PERCPU_BASE(self, cpu): 264 cpu_data = self.arm64_CpuDataEntries.chkGetChildAtIndex(cpu) 265 boot_vaddr = self.arm64_BootCpuData.GetLoadAddress() 266 267 return cpu_data.xGetIntegerByName('cpu_data_vaddr') - boot_vaddr 268 269 def make_address(self, addr): 270 sign_mask = self.arm64_sign_mask 271 addr = addr & (sign_mask + sign_mask - 1) 272 return ((addr ^ sign_mask) - sign_mask) & 0xffffffffffffffff 273 274 275class _KMemARM64e(_KMemARM64): 276 """ 277 Specialization of KMem for arm64e 278 """ 279 280 @property 281 def has_ptrauth(self): 282 return True 283 284 285class _KMemX86(KMem): 286 """ 287 Specialization of KMem for Intel 288 """ 289 290 def __init__(self, target): 291 super().__init__(target) 292 293 self.intel_cpu_data = target.chkFindFirstGlobalVariable('cpu_data_ptr') 294 295 @property 296 def has_ptrauth(self): 297 return False 298 299 def PERCPU_BASE(self, cpu): 300 cpu_data = self.intel_cpu_data.chkGetChildAtIndex(cpu) 301 return cpu_data.xGetIntegerByName('cpu_pcpu_base') 302 303 def make_address(self, addr): 304 return addr 305 306 307class PERCPUValue(object): 308 """ 309 Provides an enumerator for a percpu value 310 """ 311 312 def __init__(self, name, target = None): 313 """ 314 @param name (str) 315 The percpu slot name 316 317 @param target (SBTarget or None) 318 """ 319 320 self.kmem = KMem.get_shared() 321 self.sbv = self.kmem.target.chkFindFirstGlobalVariable('percpu_slot_' + name) 322 323 def __getitem__(self, cpu): 324 if cpu in self.kmem.pcpus: 325 sbv = self.sbv 326 addr = sbv.GetLoadAddress() + self.kmem.PERCPU_BASE(cpu) 327 return sbv.chkCreateValueFromAddress(sbv.GetName(), addr, sbv.GetType()) 328 raise IndexError 329 330 def __iter__(self): 331 return (item[1] for items in self.items()) 332 333 def items(self): 334 """ 335 Iterator of (cpu, SBValue) tuples for the given PERCPUValue 336 """ 337 338 kmem = self.kmem 339 sbv = self.sbv 340 name = sbv.GetName() 341 ty = sbv.GetType() 342 addr = sbv.GetLoadAddress() 343 344 return ( 345 (cpu, sbv.chkCreateValueFromAddress(name, addr + kmem.PERCPU_BASE(cpu), ty)) 346 for cpu in kmem.pcpus 347 ) 348 349__all__ = [ 350 KMem.__name__, 351 MemoryRange.__name__, 352 PERCPUValue.__name__, 353] 354