BadXNU, a rotten apple! – CodeBlue 2014, SyScan 2015 slides and source code

The last SyScan is almost here so it’s time to get again into a plane and travel to Singapore.
This means that the slides and source code can finally be released. Below you can find the archive with both presentations slides (they are slightly different, SyScan fixes/upgrades a few things) and full source code for both rootkit/kext loaders.

I hope you enjoy them; they are quite fun techniques, in particular the second one which now I sort of regret to disclose because it’s so cool.
I’ve also written a book chapter about both techniques (53 pages before editing) which add a few more tricks. I’m working on the book so hopefully it will finally come out this year.

The archive password will be released on the day of my presentation (27th March) so keep an eye on Twitter and SyScan website. If you crack it before that keep its contents private ;-).

If you are at SyScan feel free to have a chat. I’m there to meet new people and also learn.

Hope you enjoy,

Dropbox Mirror:

Update: The archive password is “syscan_rules_blackhat_sucks!”.
The final version presented at SyScan (really minor changes) can be download here.
The full source code is available at GitHub, diagnostic_service and diagnostic_service2.

27 thoughts on “BadXNU, a rotten apple! – CodeBlue 2014, SyScan 2015 slides and source code

  1. First of all thanks for always releasing full source code for the techniques you are using! Neat trick abusing that Apple kext for HW access. I’m Looking forward re-implementing everything into my own Rootkit in C++. Next time I hope to see some new in-kernel tricks, it was quite unexpected for me to only see user-land code but ok. And by the way, there is also a really simple way to bypass Kext signing just by using kext_request() API, as you know signature is validated byte binaries in the kext_tools package. Example code how to do that.

    1. What do you mean by in-kernel tricks? The point here is how to load kernel code bypassing both the code signing and usual APIs. The advantage here is way less work regarding hiding your footprints in regular interfaces (clearing the IOKit dictionary with kexts isn’t that super stable/clean).
      I certainly know kext_request; it was presented this year by both processor_set_tasks() Taiwanese researchers. Honestly there’s no science bypassing code signing as long the signature is verified at ring 3. As a matter of fact I quite regret having disclosed the AppleHWAccess trick 😉

      1. Yeah, I can feel with you that regret disclosing the second technique. Its really nice. We’ll see if AppleHWAccess.kext remains its IOUserClient as is now or Apple does some changes to it, but I doubt it.

        By in-kernel tricks I simply meant kernel-level code that does DKOM on something I’m not aware of or have already forgotten about . And I totally agree with you, ring3 code verification is a design mess and there will always be lots of ways breaking it.

  2. Hi 🙂 Is there video of your presentation from SyScan or CodeBlue?
    It’s very interesting topic, appreciate your work.

    1. CodeBlue planned to release videos of all the talks. I had a request to delay mine until SyScan.
      SyScan also releases videos but I have no idea about dates.

  3. Hello, fG! Good paper and thank you for the source code. Patching kextd or using kernel vulnerability method allow us to start our kext without sign, but how to make kext with autostart after reboot?

  4. Also, I try to load iokit kext via your diagnostic_service util, but it doesn’t work. I think, it’s because iokit kext start function not in the kmod->start_addr. Can you help me?

      1. To start iokit kext kextutil launch mydriver::init and mydriver::start fucntions. If I set entrypoint in “diagnostic_service” to mydriver::init then my system crash to BSOD, if I set entrypoint in “diagnostic_service” to mydriver::start, then my driver restarting in the loop

        1. You will have to check the crash logs and see what’s happening. Most probably bad memory references in the code or something.
          I don’t see any fundamental differences between the IOKit and regular kexts, so it’s probably a matter of checking where it is failing and adjusting code for IOKit case.

  5. These are all symbols in my iokit kext (com_empty_kext):
    [DEBUG] Symbol:empty_driver.cpp at 0x0
    [DEBUG] Symbol: at 0xa50
    [DEBUG] Symbol:___cxx_global_var_init at 0xa50
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0xa70
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassC1Ev at 0xa70
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0xa90
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassD1Ev at 0xa90
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0xac0
    [DEBUG] Symbol:__ZN14com_empty_kextC2EPK11OSMetaClass at 0xac0
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0xb10
    [DEBUG] Symbol:__ZN14com_empty_kextC1EPK11OSMetaClass at 0xb10
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0xb40
    [DEBUG] Symbol:__ZN14com_empty_kextD2Ev at 0xb40
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0xb60
    [DEBUG] Symbol:__ZN14com_empty_kextD1Ev at 0xb60
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0xb90
    [DEBUG] Symbol:__ZN14com_empty_kextD0Ev at 0xb90
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0xbc0
    [DEBUG] Symbol:__ZNK14com_empty_kext12getMetaClassEv at 0xbc0
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0xbe0
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassC2Ev at 0xbe0
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0xc30
    [DEBUG] Symbol:__ZNK14com_empty_kext9MetaClass5allocEv at 0xc30
    [DEBUG] Symbol: at 0x40
    [DEBUG] Symbol: at 0x40
    [DEBUG] Symbol: at 0xc70
    [DEBUG] Symbol:__ZN14com_empty_kextC1Ev at 0xc70
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0xc90
    [DEBUG] Symbol:__ZN14com_empty_kextC2Ev at 0xc90
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0xce0
    [DEBUG] Symbol:__ZN14com_empty_kext4initEP12OSDictionary at 0xce0
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0xd40
    [DEBUG] Symbol:__ZN14com_empty_kext4freeEv at 0xd40
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0x50
    [DEBUG] Symbol: at 0xd90
    [DEBUG] Symbol:__ZN14com_empty_kext5probeEP9IOServicePi at 0xd90
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0xdf0
    [DEBUG] Symbol:__ZN14com_empty_kext5startEP9IOService at 0xdf0
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0xe50
    [DEBUG] Symbol:__ZN14com_empty_kext4stopEP9IOService at 0xe50
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0x60
    [DEBUG] Symbol: at 0xeb0
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassD0Ev at 0xeb0
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0x30
    [DEBUG] Symbol: at 0xee0
    [DEBUG] Symbol:__ZN11OSMetaClassdlEPvm at 0xee0
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0x20
    [DEBUG] Symbol: at 0xf00
    [DEBUG] Symbol:__GLOBAL__sub_I_empty_driver.cpp at 0xf00
    [DEBUG] Symbol: at 0x10
    [DEBUG] Symbol: at 0x10
    [DEBUG] Symbol: at 0xf10
    [DEBUG] Symbol:__GLOBAL__D_a at 0xf10
    [DEBUG] Symbol: at 0x12
    [DEBUG] Symbol: at 0x12
    [DEBUG] Symbol:__ZN14com_empty_kext9metaClassE at 0x0
    [DEBUG] Symbol:__ZN14com_empty_kext10superClassE at 0x0
    [DEBUG] Symbol:__ZTV14com_empty_kext at 0x0
    [DEBUG] Symbol:__ZTVN14com_empty_kext9MetaClassE at 0x0
    [DEBUG] Symbol:__ZN14com_empty_kext10gMetaClassE at 0x0
    [DEBUG] Symbol: at 0x0
    [DEBUG] Symbol:_kmod_info at 0x0
    [DEBUG] Symbol:__kext_apple_cc at 0x0
    [DEBUG] Symbol:__realmain at 0x0
    [DEBUG] Symbol:__antimain at 0x0
    [DEBUG] Symbol: at 0x0
    [DEBUG] Symbol:___cxx_global_var_init at 0xa50
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassD1Ev at 0xa90
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassD0Ev at 0xeb0
    [DEBUG] Symbol:__ZN11OSMetaClassdlEPvm at 0xee0
    [DEBUG] Symbol:__GLOBAL__sub_I_empty_driver.cpp at 0xf00
    [DEBUG] Symbol:__GLOBAL__D_a at 0xf10
    [DEBUG] Symbol:__start at 0xf22
    [DEBUG] Symbol:_OSKextGetCurrentIdentifier at 0xf3c
    [DEBUG] Symbol:_OSKextGetCurrentVersionString at 0xf4d
    [DEBUG] Symbol:_OSKextGetCurrentLoadTag at 0xf5e
    [DEBUG] Symbol:__stop at 0xf6e
    [DEBUG] Symbol:__kext_apple_cc at 0x1a4c
    [DEBUG] Symbol:__realmain at 0x1a78
    [DEBUG] Symbol:__antimain at 0x1a80
    [DEBUG] Symbol:__ZN14com_empty_kext10gMetaClassE at 0x1a50
    [DEBUG] Symbol:__ZN14com_empty_kext10superClassE at 0x1028
    [DEBUG] Symbol:__ZN14com_empty_kext4freeEv at 0xd40
    [DEBUG] Symbol:__ZN14com_empty_kext4initEP12OSDictionary at 0xce0
    [DEBUG] Symbol:__ZN14com_empty_kext4stopEP9IOService at 0xe50
    [DEBUG] Symbol:__ZN14com_empty_kext5probeEP9IOServicePi at 0xd90
    [DEBUG] Symbol:__ZN14com_empty_kext5startEP9IOService at 0xdf0
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassC1Ev at 0xa70
    [DEBUG] Symbol:__ZN14com_empty_kext9MetaClassC2Ev at 0xbe0
    [DEBUG] Symbol:__ZN14com_empty_kext9metaClassE at 0x1020
    [DEBUG] Symbol:__ZN14com_empty_kextC1EPK11OSMetaClass at 0xb10
    [DEBUG] Symbol:__ZN14com_empty_kextC1Ev at 0xc70
    [DEBUG] Symbol:__ZN14com_empty_kextC2EPK11OSMetaClass at 0xac0
    [DEBUG] Symbol:__ZN14com_empty_kextC2Ev at 0xc90
    [DEBUG] Symbol:__ZN14com_empty_kextD0Ev at 0xb90
    [DEBUG] Symbol:__ZN14com_empty_kextD1Ev at 0xb60
    [DEBUG] Symbol:__ZN14com_empty_kextD2Ev at 0xb40
    [DEBUG] Symbol:__ZNK14com_empty_kext12getMetaClassEv at 0xbc0
    [DEBUG] Symbol:__ZNK14com_empty_kext9MetaClass5allocEv at 0xc30
    [DEBUG] Symbol:__ZTV14com_empty_kext at 0x1030
    [DEBUG] Symbol:__ZTVN14com_empty_kext9MetaClassE at 0x18a0
    [DEBUG] Symbol:_kmod_info at 0x1988
    [DEBUG] Symbol:_IOLog at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass0Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass1Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass2Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass3Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass4Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass5Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass6Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClass21_RESERVEDOSMetaClass7Ev at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClassC2EPKcPKS_j at 0x0
    [DEBUG] Symbol:__ZN11OSMetaClassD2Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11detachAboveEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setLocationEPK8OSSymbolPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setLocationEPKcPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setPropertyEPK8OSStringP8OSObject at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setPropertyEPK8OSSymbolP8OSObject at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setPropertyEPKcP8OSObject at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setPropertyEPKcPvj at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setPropertyEPKcS1_ at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setPropertyEPKcb at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry11setPropertyEPKcyj at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry13attachToChildEPS_PK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry13childFromPathEPKcPK15IORegistryPlanePcPi at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry13setPropertiesEP8OSObject at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry14attachToParentEPS_PK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry14removePropertyEPK8OSString at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry14removePropertyEPK8OSSymbol at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry14removePropertyEPKc at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry15detachFromChildEPS_PK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry16detachFromParentEPS_PK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry16setPropertyTableEP12OSDictionary at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry17runPropertyActionEPFiP8OSObjectPvS2_S2_S2_ES1_S2_S2_S2_S2_ at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry0Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry1Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry2Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry3Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry4Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry5Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry6Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry7Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry8Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry25_RESERVEDIORegistryEntry9Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry10Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry11Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry12Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry13Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry14Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry15Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry16Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry17Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry18Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry19Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry20Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry21Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry22Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry23Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry24Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry25Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry26Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry27Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry28Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry29Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry30Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry26_RESERVEDIORegistryEntry31Ev at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry7setNameEPK8OSSymbolPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry7setNameEPKcPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15IORegistryEntry9detachAllEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN15OSMetaClassBase25_RESERVEDOSMetaClassBase3Ev at 0x0
    [DEBUG] Symbol:__ZN15OSMetaClassBase25_RESERVEDOSMetaClassBase4Ev at 0x0
    [DEBUG] Symbol:__ZN15OSMetaClassBase25_RESERVEDOSMetaClassBase5Ev at 0x0
    [DEBUG] Symbol:__ZN15OSMetaClassBase25_RESERVEDOSMetaClassBase6Ev at 0x0
    [DEBUG] Symbol:__ZN15OSMetaClassBase25_RESERVEDOSMetaClassBase7Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject0Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject1Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject2Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject3Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject4Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject5Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject6Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject7Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject8Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject18_RESERVEDOSObject9Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject19_RESERVEDOSObject10Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject19_RESERVEDOSObject11Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject19_RESERVEDOSObject12Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject19_RESERVEDOSObject13Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject19_RESERVEDOSObject14Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject19_RESERVEDOSObject15Ev at 0x0
    [DEBUG] Symbol:__ZN8OSObject4initEv at 0x0
    [DEBUG] Symbol:__ZN8OSObjectdlEPvm at 0x0
    [DEBUG] Symbol:__ZN8OSObjectnwEm at 0x0
    [DEBUG] Symbol:__ZN9IOService10adjustBusyEi at 0x0
    [DEBUG] Symbol:__ZN9IOService10gMetaClassE at 0x0
    [DEBUG] Symbol:__ZN9IOService10handleOpenEPS_jPv at 0x0
    [DEBUG] Symbol:__ZN9IOService10joinPMtreeEPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService11handleCloseEPS_j at 0x0
    [DEBUG] Symbol:__ZN9IOService12didTerminateEPS_jPb at 0x0
    [DEBUG] Symbol:__ZN9IOService12getBusyStateEv at 0x0
    [DEBUG] Symbol:__ZN9IOService12getResourcesEv at 0x0
    [DEBUG] Symbol:__ZN9IOService12requestProbeEj at 0x0
    [DEBUG] Symbol:__ZN9IOService12tellChangeUpEm at 0x0
    [DEBUG] Symbol:__ZN9IOService12updateReportEP19IOReportChannelListjPvS2_ at 0x0
    [DEBUG] Symbol:__ZN9IOService13addPowerChildEPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService13askChangeDownEm at 0x0
    [DEBUG] Symbol:__ZN9IOService13matchLocationEPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService13messageClientEjP8OSObjectPvm at 0x0
    [DEBUG] Symbol:__ZN9IOService13newUserClientEP4taskPvjP12OSDictionaryPP12IOUserClient at 0x0
    [DEBUG] Symbol:__ZN9IOService13newUserClientEP4taskPvjPP12IOUserClient at 0x0
    [DEBUG] Symbol:__ZN9IOService13setPowerStateEmPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService13willTerminateEPS_j at 0x0
    [DEBUG] Symbol:__ZN9IOService14activityTickleEmm at 0x0
    [DEBUG] Symbol:__ZN9IOService14applyToClientsEPFvPS_PvES1_ at 0x0
    [DEBUG] Symbol:__ZN9IOService14causeInterruptEi at 0x0
    [DEBUG] Symbol:__ZN9IOService14messageClientsEjPvm at 0x0
    [DEBUG] Symbol:__ZN9IOService14tellChangeDownEm at 0x0
    [DEBUG] Symbol:__ZN9IOService15comparePropertyEP12OSDictionaryPK8OSString at 0x0
    [DEBUG] Symbol:__ZN9IOService15comparePropertyEP12OSDictionaryPKc at 0x0
    [DEBUG] Symbol:__ZN9IOService15configureReportEP19IOReportChannelListjPvS2_ at 0x0
    [DEBUG] Symbol:__ZN9IOService15enableInterruptEi at 0x0
    [DEBUG] Symbol:__ZN9IOService15errnoFromReturnEi at 0x0
    [DEBUG] Symbol:__ZN9IOService15getDeviceMemoryEv at 0x0
    [DEBUG] Symbol:__ZN9IOService15nextIdleTimeoutEyyj at 0x0
    [DEBUG] Symbol:__ZN9IOService15powerChangeDoneEm at 0x0
    [DEBUG] Symbol:__ZN9IOService15registerServiceEj at 0x0
    [DEBUG] Symbol:__ZN9IOService15setDeviceMemoryEP7OSArray at 0x0
    [DEBUG] Symbol:__ZN9IOService15terminateClientEPS_j at 0x0
    [DEBUG] Symbol:__ZN9IOService16allowPowerChangeEm at 0x0
    [DEBUG] Symbol:__ZN9IOService16applyToProvidersEPFvPS_PvES1_ at 0x0
    [DEBUG] Symbol:__ZN9IOService16disableInterruptEi at 0x0
    [DEBUG] Symbol:__ZN9IOService16getInterruptTypeEiPi at 0x0
    [DEBUG] Symbol:__ZN9IOService16registerInterestEPK8OSSymbolPFiPvS3_jPS_S3_mES3_S3_ at 0x0
    [DEBUG] Symbol:__ZN9IOService16removePowerChildEP17IOPowerConnection at 0x0
    [DEBUG] Symbol:__ZN9IOService16requestTerminateEPS_j at 0x0
    [DEBUG] Symbol:__ZN9IOService16stringFromReturnEi at 0x0
    [DEBUG] Symbol:__ZN9IOService16tellNoChangeDownEm at 0x0
    [DEBUG] Symbol:__ZN9IOService17addNeededResourceEPKc at 0x0
    [DEBUG] Symbol:__ZN9IOService17applyToInterestedEPK8OSSymbolPFvP8OSObjectPvES5_ at 0x0
    [DEBUG] Symbol:__ZN9IOService17cancelPowerChangeEm at 0x0
    [DEBUG] Symbol:__ZN9IOService17comparePropertiesEP12OSDictionaryP12OSCollection at 0x0
    [DEBUG] Symbol:__ZN9IOService17getAggressivenessEmPm at 0x0
    [DEBUG] Symbol:__ZN9IOService17registerInterruptEiP8OSObjectPFvS1_PvPS_iES2_ at 0x0
    [DEBUG] Symbol:__ZN9IOService17setAggressivenessEmm at 0x0
    [DEBUG] Symbol:__ZN9IOService18lockForArbitrationEb at 0x0
    [DEBUG] Symbol:__ZN9IOService18matchPropertyTableEP12OSDictionary at 0x0
    [DEBUG] Symbol:__ZN9IOService18matchPropertyTableEP12OSDictionaryPi at 0x0
    [DEBUG] Symbol:__ZN9IOService18setIdleTimerPeriodEm at 0x0
    [DEBUG] Symbol:__ZN9IOService18systemWillShutdownEj at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService2Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService3Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService4Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService5Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService6Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService7Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService8Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19_RESERVEDIOService9Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService19registerPowerDriverEPS_P14IOPMPowerStatem at 0x0
    [DEBUG] Symbol:__ZN9IOService19unregisterInterruptEi at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService10Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService11Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService12Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService13Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService14Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService15Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService16Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService17Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService18Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService19Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService20Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService21Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService22Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService23Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService24Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService25Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService26Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService27Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService28Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService29Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService30Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService31Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService32Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService33Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService34Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService35Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService36Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService37Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService38Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService39Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService40Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService41Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService42Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService43Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService44Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService45Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService46Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20_RESERVEDIOService47Ev at 0x0
    [DEBUG] Symbol:__ZN9IOService20callPlatformFunctionEPK8OSSymbolbPvS3_S3_S3_ at 0x0
    [DEBUG] Symbol:__ZN9IOService20callPlatformFunctionEPKcbPvS2_S2_S2_ at 0x0
    [DEBUG] Symbol:__ZN9IOService20getDeviceMemoryCountEv at 0x0
    [DEBUG] Symbol:__ZN9IOService20unlockForArbitrationEv at 0x0
    [DEBUG] Symbol:__ZN9IOService21powerStateDidChangeToEmmPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService22copyClientWithCategoryEPK8OSSymbol at 0x0
    [DEBUG] Symbol:__ZN9IOService22powerStateWillChangeToEmmPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService23acknowledgeNotificationEPvj at 0x0
    [DEBUG] Symbol:__ZN9IOService23requestPowerDomainStateEmP17IOPowerConnectionm at 0x0
    [DEBUG] Symbol:__ZN9IOService24getDeviceMemoryWithIndexEj at 0x0
    [DEBUG] Symbol:__ZN9IOService24mapDeviceMemoryWithIndexEjj at 0x0
    [DEBUG] Symbol:__ZN9IOService24powerStateForDomainStateEm at 0x0
    [DEBUG] Symbol:__ZN9IOService27maxCapabilityForDomainStateEm at 0x0
    [DEBUG] Symbol:__ZN9IOService31initialPowerStateForDomainStateEm at 0x0
    [DEBUG] Symbol:__ZN9IOService4initEP15IORegistryEntryPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZN9IOService4openEPS_jPv at 0x0
    [DEBUG] Symbol:__ZN9IOService5closeEPS_j at 0x0
    [DEBUG] Symbol:__ZN9IOService6PMinitEv at 0x0
    [DEBUG] Symbol:__ZN9IOService6PMstopEv at 0x0
    [DEBUG] Symbol:__ZN9IOService6attachEPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService6detachEPS_ at 0x0
    [DEBUG] Symbol:__ZN9IOService7messageEjPS_Pv at 0x0
    [DEBUG] Symbol:__ZN9IOService8finalizeEj at 0x0
    [DEBUG] Symbol:__ZN9IOService9terminateEj at 0x0
    [DEBUG] Symbol:__ZN9IOServiceC2EPK11OSMetaClass at 0x0
    [DEBUG] Symbol:__ZN9IOServiceD2Ev at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass12getMetaClassEv at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass12taggedRetainEPKv at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass13taggedReleaseEPKv at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass13taggedReleaseEPKvi at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass14getRetainCountEv at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass19instanceConstructedEv at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass6retainEv at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass7releaseEi at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass7releaseEv at 0x0
    [DEBUG] Symbol:__ZNK11OSMetaClass9serializeEP11OSSerialize at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11compareNameEP8OSStringPS1_ at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11getLocationEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11getPropertyEPK8OSString at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11getPropertyEPK8OSStringPK15IORegistryPlanej at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11getPropertyEPK8OSSymbol at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11getPropertyEPK8OSSymbolPK15IORegistryPlanej at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11getPropertyEPKc at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry11getPropertyEPKcPK15IORegistryPlanej at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12compareNamesEP8OSObjectPP8OSString at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12copyLocationEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12copyPropertyEPK8OSString at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12copyPropertyEPK8OSStringPK15IORegistryPlanej at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12copyPropertyEPK8OSSymbol at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12copyPropertyEPK8OSSymbolPK15IORegistryPlanej at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12copyPropertyEPKc at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry12copyPropertyEPKcPK15IORegistryPlanej at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry13getChildEntryEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry14applyToParentsEPFvPS_PvES1_PK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry14copyChildEntryEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry14getParentEntryEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry15applyToChildrenEPFvPS_PvES1_PK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry15copyParentEntryEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry16getChildIteratorEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry16getPathComponentEPcPiPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry17getParentIteratorEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry24dictionaryWithPropertiesEv at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry7getNameEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry7getPathEPcPiPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry7inPlaneEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry7isChildEPS_PK15IORegistryPlaneb at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry8copyNameEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry8getDepthEPK15IORegistryPlane at 0x0
    [DEBUG] Symbol:__ZNK15IORegistryEntry8isParentEPS_PK15IORegistryPlaneb at 0x0
    [DEBUG] Symbol:__ZNK15OSMetaClassBase9isEqualToEPKS_ at 0x0
    [DEBUG] Symbol:__ZNK8OSObject12taggedRetainEPKv at 0x0
    [DEBUG] Symbol:__ZNK8OSObject13taggedReleaseEPKv at 0x0
    [DEBUG] Symbol:__ZNK8OSObject13taggedReleaseEPKvi at 0x0
    [DEBUG] Symbol:__ZNK8OSObject14getRetainCountEv at 0x0
    [DEBUG] Symbol:__ZNK8OSObject6retainEv at 0x0
    [DEBUG] Symbol:__ZNK8OSObject7releaseEi at 0x0
    [DEBUG] Symbol:__ZNK8OSObject7releaseEv at 0x0
    [DEBUG] Symbol:__ZNK8OSObject9serializeEP11OSSerialize at 0x0
    [DEBUG] Symbol:__ZNK9IOService11getProviderEv at 0x0
    [DEBUG] Symbol:__ZNK9IOService11getWorkLoopEv at 0x0
    [DEBUG] Symbol:__ZNK9IOService12handleIsOpenEPKS_ at 0x0
    [DEBUG] Symbol:__ZNK9IOService17getClientIteratorEv at 0x0
    [DEBUG] Symbol:__ZNK9IOService19getProviderIteratorEv at 0x0
    [DEBUG] Symbol:__ZNK9IOService19serializePropertiesEP11OSSerialize at 0x0
    [DEBUG] Symbol:__ZNK9IOService21getOpenClientIteratorEv at 0x0
    [DEBUG] Symbol:__ZNK9IOService23getOpenProviderIteratorEv at 0x0
    [DEBUG] Symbol:__ZNK9IOService6isOpenEPKS_ at 0x0
    [DEBUG] Symbol:__ZNK9IOService8getStateEv at 0x0
    [DEBUG] Symbol:__ZNK9IOService9getClientEv at 0x0
    [DEBUG] Symbol:__ZTV9IOService at 0x0

    I try to set entrypoint both to __ZN14com_empty_kext4initEP12OSDictionary and __ZN14com_empty_kext5startEP9IOService, as i wrote above without success

  6. Hi! I think, that IOKit kext and regular kext have many differences. For example, iokit kext uses IOKit Framework and have an other launch mechanism (there is no single entry point). I decide that the easiest way to bypass kext signing is through the re-compiling kextutil from the Apple’s sources (patch ). But I can’t compile it ’cause of many strange error (I use XCode 6.3 and OS X 10.10.3) Could you help me? Is there same special compliler or linker options?

    1. There are no fundamental differences between the two. You just need to trigger the init, prob, start methods in order, using a small shellcode instead of a single call to a entrypoint. Nothing hard to implement.
      The easiest way to bypass kext signing is to directly patch kextd, which is a couple of bytes patch. I have no idea about recompiling it, usually it doesn’t work because missing headers from Apple. You will need to check the code and rebuild yourself the headers or remove functionalities that use those headers.

  7. How can I found address of function SecStaticCodeCheckValidity via mach_port_t? Or I must do it like resolving symbols in the kernel image? KASLR slide is the same fr all executables?

  8. I want to launch unsigned iokit kext. As you mentioned above, the easiest way to do it is to patch in runtime the kextd daemon. I know how to write kexts and IOKit kexts, but I don’t understand how to find place in kextd (function SecStaticCodeCheckValidity). I suggest, I can find this symbol from kextd file in the hard disk, but I don’t know is there something like aslr?

    1. You just need to crack kextd. Load kextd into a dissassembler, find the location, patch it, save and replace it.
      It can be done in a dynamic way, not very difficult to implement.

  9. I patched kextd executable (mov ebx,eax –> mov eax,eax after the call _SecStaticCodeCheckValidity) and replace it, but my unsigned kext didn’t load. What is wrong?

  10. I’m sorry, I misspeld: I replace mov ebx,eax to xor eax,eax. But i think, I need to add xor eax,eax before mov ebx,eax, right? But how to do it – it will make all offsets it executable wrong

    1. You need to keep the remaining instructions intact, you can’t just patch code that overwrites other instructions space.
      So you need to learn how to patch applications.

      You can simply load unsigned kexts by setting the proper boot flag without all this work, if that’s your only goal.

  11. I try to insert trampoline [mov reg, addr; jmp addr] = 7 bytes after call _SecStaticCodeCheckValidity to island, where I make [xor eax,eax; repeat original commands; comeback]. But I can’t find enough free space (at least 17 bytes) for my island in code section of kextd file. Can you help me?

Leave a Reply

Your email address will not be published. Required fields are marked *