diff --git a/TeraScaleFixup.xcodeproj/project.pbxproj b/TeraScaleFixup.xcodeproj/project.pbxproj index e5770a6..47acb90 100644 --- a/TeraScaleFixup.xcodeproj/project.pbxproj +++ b/TeraScaleFixup.xcodeproj/project.pbxproj @@ -26,7 +26,7 @@ CEDE8D5522984F7600C73034 /* kern_user.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = kern_user.hpp; sourceTree = ""; }; CEDE8D5622984F7600C73034 /* plugin_start.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = plugin_start.hpp; sourceTree = ""; }; CEDE8D5722984F7600C73034 /* kern_iokit.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = kern_iokit.hpp; sourceTree = ""; }; - CEDE8D5822984F7600C73034 /* kern_crypto.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = kern_crypto.hpp; sourceTree = ""; }; + CEDE8D5822984F7600C73034 /* kern_jazzzo.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = kern_jazzzo.hpp; sourceTree = ""; }; CEDE8D5922984F7600C73034 /* kern_mach.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = kern_mach.hpp; sourceTree = ""; }; CEDE8D5A22984F7600C73034 /* kern_compression.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = kern_compression.hpp; sourceTree = ""; }; CEDE8D5B22984F7600C73034 /* kern_file.hpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.h; path = kern_file.hpp; sourceTree = ""; }; @@ -120,7 +120,7 @@ CEDE8D5522984F7600C73034 /* kern_user.hpp */, CEDE8D5622984F7600C73034 /* plugin_start.hpp */, CEDE8D5722984F7600C73034 /* kern_iokit.hpp */, - CEDE8D5822984F7600C73034 /* kern_crypto.hpp */, + CEDE8D5822984F7600C73034 /* kern_jazzzo.hpp */, CEDE8D5922984F7600C73034 /* kern_mach.hpp */, CEDE8D5A22984F7600C73034 /* kern_compression.hpp */, CEDE8D5B22984F7600C73034 /* kern_file.hpp */, @@ -215,7 +215,7 @@ dependencies = ( ); name = TeraScaleFixup; - productName = CryptexFixup; + productName = TeraScaleFixup; productReference = CEDE8CE522984C0800C73034 /* TeraScaleFixup.kext */; productType = "com.apple.product-type.kernel-extension"; }; @@ -349,7 +349,7 @@ GCC_WARN_UNUSED_VARIABLE = YES; KERNEL_EXTENSION_HEADER_SEARCH_PATHS = "$(PROJECT_DIR)/MacKernelSDK/Headers"; KERNEL_FRAMEWORK_HEADERS = "$(PROJECT_DIR)/MacKernelSDK/Headers"; - MACOSX_DEPLOYMENT_TARGET = 10.11; + MACOSX_DEPLOYMENT_TARGET = 10.7; MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE; MTL_FAST_MATH = YES; ONLY_ACTIVE_ARCH = YES; @@ -405,7 +405,7 @@ GCC_WARN_UNUSED_VARIABLE = YES; KERNEL_EXTENSION_HEADER_SEARCH_PATHS = "$(PROJECT_DIR)/MacKernelSDK/Headers"; KERNEL_FRAMEWORK_HEADERS = "$(PROJECT_DIR)/MacKernelSDK/Headers"; - MACOSX_DEPLOYMENT_TARGET = 10.11; + MACOSX_DEPLOYMENT_TARGET = 10.7; MTL_ENABLE_DEBUG_INFO = NO; MTL_FAST_MATH = YES; SDKROOT = macosx; @@ -418,7 +418,7 @@ CLANG_WARN_DOCUMENTATION_COMMENTS = NO; CODE_SIGN_STYLE = Automatic; COMBINE_HIDPI_IMAGES = YES; - CURRENT_PROJECT_VERSION = 1.0; + CURRENT_PROJECT_VERSION = 1.0.0; GCC_PREPROCESSOR_DEFINITIONS = ( "$(inherited)", "MODULE_VERSION=$(MODULE_VERSION)", @@ -428,11 +428,11 @@ INFOPLIST_FILE = "$(SRCROOT)/TeraScaleFixup/Info.plist"; LIBRARY_SEARCH_PATHS = "$(PROJECT_DIR)/MacKernelSDK/Library/x86_64"; MACOSX_DEPLOYMENT_TARGET = 10.7; - MARKETING_VERSION = 1.0; + MARKETING_VERSION = 1.0.0; MODULE_NAME = com.jazzzny.terascalefixup; MODULE_START = "$(PRODUCT_NAME)_kern_start"; MODULE_STOP = "$(PRODUCT_NAME)_kern_stop"; - MODULE_VERSION = 1.0; + MODULE_VERSION = 1.0.0; PRODUCT_BUNDLE_IDENTIFIER = com.jazzzny.terascalefixup; PRODUCT_NAME = "$(TARGET_NAME)"; WRAPPER_EXTENSION = kext; @@ -445,7 +445,7 @@ CLANG_WARN_DOCUMENTATION_COMMENTS = NO; CODE_SIGN_STYLE = Automatic; COMBINE_HIDPI_IMAGES = YES; - CURRENT_PROJECT_VERSION = 1.0; + CURRENT_PROJECT_VERSION = 1.0.0; GCC_PREPROCESSOR_DEFINITIONS = ( "$(inherited)", "MODULE_VERSION=$(MODULE_VERSION)", @@ -455,11 +455,11 @@ INFOPLIST_FILE = "$(SRCROOT)/TeraScaleFixup/Info.plist"; LIBRARY_SEARCH_PATHS = "$(PROJECT_DIR)/MacKernelSDK/Library/x86_64"; MACOSX_DEPLOYMENT_TARGET = 10.7; - MARKETING_VERSION = 1.0; + MARKETING_VERSION = 1.0.0; MODULE_NAME = com.jazzzny.terascalefixup; MODULE_START = "$(PRODUCT_NAME)_kern_start"; MODULE_STOP = "$(PRODUCT_NAME)_kern_stop"; - MODULE_VERSION = 1.0; + MODULE_VERSION = 1.0.0; PRODUCT_BUNDLE_IDENTIFIER = com.jazzzny.terascalefixup; PRODUCT_NAME = "$(TARGET_NAME)"; WRAPPER_EXTENSION = kext; diff --git a/TeraScaleFixup/Info.plist b/TeraScaleFixup/Info.plist index fb35a04..b9d4ad4 100644 --- a/TeraScaleFixup/Info.plist +++ b/TeraScaleFixup/Info.plist @@ -20,7 +20,7 @@ $(CURRENT_PROJECT_VERSION) IOKitPersonalities - CryptexFixup + TeraScaleFixup CFBundleIdentifier $(PRODUCT_BUNDLE_IDENTIFIER) @@ -33,9 +33,92 @@ IOResourceMatch IOKit + 4600Controller + + CFBundleIdentifier + com.apple.kext.AMD4600Controller + IOClass + AMD4600Controller + IOMatchCategory + IOFramebuffer + IOName + AMD4600Controller + IOPCIMatch + 0x94901002 0x94881002 0x94981002 0x95401002 0x954F1002 0x95531002 + IOProbeScore + 80000 + IOProviderClass + IOPCIDevice + + 4600ControllerLegacy + + CFBundleIdentifier + com.apple.kext.ATI4600Controller + IOClass + ATI4600Controller + IOMatchCategory + IOFramebuffer + IOName + ATI4600Controller + IOPCIMatch + 0x94901002 0x94881002 0x94981002 0x95401002 0x954F1002 0x95531002 + IOProbeScore + 80000 + IOProviderClass + IOPCIDevice + + 4800Controller + + CFBundleIdentifier + com.apple.kext.AMD4800Controller + IOClass + AMD4800Controller + IOMatchCategory + IOFramebuffer + IOName + AMD4800Controller + IOPCIMatch + 0x94401002 0x944a1002 0x94421002 0x94411002 0x94431002 0x944C1002 0x94601002 0x94621002 0x94b31002 + IOProbeScore + 80000 + IOProviderClass + IOPCIDevice + + 4800ControllerLegacy + + CFBundleIdentifier + com.apple.kext.ATI4800Controller + IOClass + ATI4800Controller + IOMatchCategory + IOFramebuffer + IOName + ATI4800Controller + IOPCIMatch + 0x94401002 0x944a1002 0x94421002 0x94411002 0x94431002 0x944C1002 0x94601002 0x94621002 0x94b31002 + IOProbeScore + 80000 + IOProviderClass + IOPCIDevice + + ATIRadeonX2000 + + CFBundleIdentifier + com.apple.ATIRadeonX2000 + IOClass + ATIRadeonX2000 + IOMatchCategory + IOAccelerator + IOPCIMatch + 0x94401002 0x944a1002 0x94421002 0x94411002 0x94431002 0x944C1002 0x94601002 0x94621002 0x94901002 0x94881002 0x94981002 0x95531002 0x94b31002 + IOProbeScore + 80000 + IOProviderClass + IOPCIDevice + NSHumanReadableCopyright - Copyright ©2024 Jazzzny + Copyright ©2024 Jazzzny. All rights reserved. OSBundleLibraries as.vit9696.Lilu diff --git a/TeraScaleFixup/kern_start.cpp b/TeraScaleFixup/kern_start.cpp index 0f0417b..95f9ff0 100644 --- a/TeraScaleFixup/kern_start.cpp +++ b/TeraScaleFixup/kern_start.cpp @@ -1,8 +1,8 @@ // // kern_start.cpp -// CryptexFixup.kext +// TeraScaleFixup.kext // -// Copyright © 2022 Mykola Grymalyuk. All rights reserved. +// Copyright ©2024 Jazzzny. All rights reserved. // #include @@ -10,130 +10,170 @@ #include #include -#define MODULE_SHORT "crypt_fix" +#define MODULE_SHORT "TeraScaleFixup" static mach_vm_address_t orig_cs_validate {}; static mach_vm_address_t orig_authenticate_root_hash {}; -// ramrod is stored inside a larger binary, UpdateBrainLibary -// When inspecting the RAM Disk, ramrod's path is '/usr/libexec/ramrod/ramrod' -static const char *ramrodPath = "UpdateBrainLibrary"; +// Patch for 10.7 +static UInt8 findLion[] = { 0x48, 0x0F, 0xA3, 0xD8, 0x0F, 0x83, 0x24, 0xFF, 0xFF, 0xFF, 0xBF, 0x58 }; +static UInt8 replaceLion[] = { 0x48, 0x0F, 0xA3, 0xD8, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xBF, 0x58 }; -static const uint8_t kCryptexFind[] = { - // cryptex-system-x86_64 - 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x78, 0x2D, - 0x73, 0x79, 0x73, 0x74, 0x65, 0x6D, 0x2D, - 0x78, 0x38, 0x36, 0x5F, 0x36, 0x34 -}; +// Patch for 10.8 +static UInt8 findMountainLion[] = { 0x0F, 0xA3, 0xCA, 0x0F, 0x83, 0xAE, 0x01, 0x00, 0x00, 0xBF, 0xC8, 0x05 }; +static UInt8 replaceMountainLion[] = { 0x0F, 0xA3, 0xCA, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xBF, 0xC8, 0x05 }; -static const uint8_t kCryptexReplace[] = { - // cryptex-system-arm64e - 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x78, 0x2D, - 0x73, 0x79, 0x73, 0x74, 0x65, 0x6D, 0x2D, - 0x61, 0x72, 0x6D, 0x36, 0x34, 0x65 -}; +// Patch for 10.9 +static UInt8 findMavericks[] = { 0x48, 0x0F, 0xA3, 0xC1, 0x0F, 0x83, 0x94, 0x01, 0x00, 0x00, 0xBF, 0x10 }; +static UInt8 replaceMavericks[] = { 0x48, 0x0F, 0xA3, 0xC1, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xBF, 0x10 }; -static const char *kextAPFS[] { - "/System/Library/Extensions/apfs.kext/Contents/MacOS/apfs" -}; +// Patch for 10.10 +static UInt8 findYosemite[] = { 0x04, 0x48, 0x0F, 0xA3, 0xCA, 0x0F, 0x83, 0x9B, 0x01, 0x00, 0x00, 0xBF }; +static UInt8 replaceYosemite[] = { 0x04, 0x48, 0x0F, 0xA3, 0xCA, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xBF }; -static KernelPatcher::KextInfo kextList[] { - {"com.apple.filesystems.apfs", kextAPFS, arrsize(kextAPFS), {true}, {}, KernelPatcher::KextInfo::Unloaded }, -}; +// Patch for 10.11 +static UInt8 findElCapitan[] = { 0xFF, 0x83, 0xF9, 0x1A, 0x0F, 0x87, 0x98, 0x01, 0x00, 0x00, 0xBA, 0x45, 0x44, 0x00, 0x04, 0x0F, 0xA3, 0xCA, 0x0F, 0x83, 0x8A, 0x01, 0x00, 0x00 }; +static UInt8 replaceElCapitan[] = { 0xFF, 0x83, 0xF9, 0x3A, 0x0F, 0x87, 0x98, 0x01, 0x00, 0x00, 0xBA, 0x45, 0x44, 0x00, 0x04, 0x0F, 0xA3, 0xCA, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 }; -static const char *kextAuthHashSymbol[] { - "_authenticate_root_hash" -}; +// Patch for 10.12 +static UInt8 findSierra[] = { 0x00, 0x01, 0x48, 0x0F, 0xA3, 0xCA, 0x0F, 0x83, 0xA2, 0x00, 0x00, 0x00 }; +static UInt8 replaceSierra[] = { 0x00, 0x01, 0x48, 0x0F, 0xA3, 0xCA, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 }; -#pragma mark - Kernel patching code +// Patch for 10.13 (and above) +static UInt8 findHighSierra[] = { 0x0F, 0xA3, 0xCA, 0x0F, 0x83, 0xC3, 0x00, 0x00, 0x00, 0xBF, 0x00, 0x06 }; +static UInt8 replaceHighSierra[] = { 0x0F, 0xA3, 0xCA, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xBF, 0x00, 0x06 }; -template -static inline void searchAndPatch(const void *haystack, size_t haystackSize, const char *path, const uint8_t (&needle)[findSize], const uint8_t (&patch)[replaceSize], const char *name) { - if (UNLIKELY(KernelPatcher::findAndReplace(const_cast(haystack), haystackSize, needle, findSize, patch, replaceSize))) { - DBGLOG(MODULE_SHORT, "found function %s to patch at %s!", name, path); - } -} +static const char *kextX2000[] { + "/System/Library/Extensions/ATIRadeonX2000.kext/Contents/MacOS/ATIRadeonX2000" +}; -static int patched_authenticate_root_hash(int arg0, int arg1, int arg2, int arg3, int arg4, int arg5) { - return 0; +static KernelPatcher::KextInfo kextList[] { + {"com.apple.ATIRadeonX2000", kextX2000, arrsize(kextX2000), {true}, {}, KernelPatcher::KextInfo::Unloaded }, }; + +#pragma mark - Kernel patching code + static void processKext(KernelPatcher &patcher, size_t index, mach_vm_address_t address, size_t size) { - // Check apfs.kext is loaded + // Check ATIRadeonX2000 is loaded if (index != kextList[0].loadIndex) { return; } - // Force '_authenticate_root_hash' to return 0 - KernelPatcher::RouteRequest request (kextAuthHashSymbol[0], patched_authenticate_root_hash, orig_authenticate_root_hash); - if (!patcher.routeMultiple(index, &request, 1, address , size)) { - SYSLOG(MODULE_SHORT, "patcher.routeMultiple for %s failed with error %d", request.symbol, patcher.getError()); + const KernelPatcher::LookupPatch patchLion = { + &kextList[0], + findLion, + replaceLion, + sizeof(findLion), + 1 + }; + + const KernelPatcher::LookupPatch patchMountainLion = { + &kextList[0], + findMountainLion, + replaceMountainLion, + sizeof(findMountainLion), + 1 + }; + + const KernelPatcher::LookupPatch patchMavericks = { + &kextList[0], + findMavericks, + replaceMavericks, + sizeof(findMavericks), + 1 + }; + + const KernelPatcher::LookupPatch patchYosemite = { + &kextList[0], + findYosemite, + replaceYosemite, + sizeof(findYosemite), + 1 + }; + + const KernelPatcher::LookupPatch patchElCapitan = { + &kextList[0], + findElCapitan, + replaceElCapitan, + sizeof(findElCapitan), + 1 + }; + + const KernelPatcher::LookupPatch patchSierra = { + &kextList[0], + findSierra, + replaceSierra, + sizeof(findSierra), + 1 + }; + + const KernelPatcher::LookupPatch patchHighSierra = { + &kextList[0], + findHighSierra, + replaceHighSierra, + sizeof(findHighSierra), + 1 + }; + + switch (getKernelVersion()) { + case KernelVersion::Lion: + patcher.applyLookupPatch(&patchLion); + break; + case KernelVersion::MountainLion: + patcher.applyLookupPatch(&patchMountainLion); + break; + case KernelVersion::Mavericks: + patcher.applyLookupPatch(&patchMavericks); + break; + case KernelVersion::Yosemite: + patcher.applyLookupPatch(&patchYosemite); + break; + case KernelVersion::ElCapitan: + patcher.applyLookupPatch(&patchElCapitan); + break; + case KernelVersion::Sierra: + patcher.applyLookupPatch(&patchSierra); + break; + case KernelVersion::HighSierra: + patcher.applyLookupPatch(&patchHighSierra); + break; + default: // Assume kexts are installed and functional - no harm is done if they are not present. + patcher.applyLookupPatch(&patchHighSierra); + } + + if (patcher.getError() != KernelPatcher::Error::NoError) { + SYSLOG(MODULE_SHORT, "Failed to apply ATIRadeonX2000 patch"); patcher.clearError(); } + else { + SYSLOG(MODULE_SHORT, "ATIRadeonX2000 patch applied"); + } } -#pragma mark - Patched functions - -static void patched_cs_validate_page(vnode_t vp, memory_object_t pager, memory_object_offset_t page_offset, const void *data, int *validated_p, int *tainted_p, int *nx_p) { - char path[PATH_MAX]; - int pathlen = PATH_MAX; - FunctionCast(patched_cs_validate_page, orig_cs_validate)(vp, pager, page_offset, data, validated_p, tainted_p, nx_p); - - if (vn_getpath(vp, path, &pathlen) == 0) { - // Binary is copied into a tmp location, thus partial match - if (UNLIKELY(strstr(path, ramrodPath) != NULL)) { - searchAndPatch(data, PAGE_SIZE, path, kCryptexFind, kCryptexReplace, "Cryptex Disk Image"); - } - } -} - #pragma mark - Patches on start/stop static void pluginStart() { DBGLOG(MODULE_SHORT, "start"); - if (BaseDeviceInfo::get().cpuHasAvx2) { - if (checkKernelArgument("-crypt_force_avx")) { - SYSLOG(MODULE_SHORT, "system natively support AVX2.0, but forcing AVX patch upon user request"); - } else { - SYSLOG(MODULE_SHORT, "system natively support AVX2.0, skipping"); - return; - } - } - // Userspace Patcher (ramrod) - // Support Big Sur and newer for in-place Install macOS.app usage - if (getKernelVersion() >= KernelVersion::BigSur) { - lilu.onPatcherLoadForce([](void *user, KernelPatcher &patcher) { - KernelPatcher::RouteRequest csRoute = KernelPatcher::RouteRequest("_cs_validate_page", patched_cs_validate_page, orig_cs_validate); - if (!patcher.routeMultipleLong(KernelPatcher::KernelID, &csRoute, 1)) - SYSLOG(MODULE_SHORT, "failed to route cs validation pages"); - }); - } - - // Kernel Space Patcher (APFS.kext) - if (getKernelVersion() >= KernelVersion::Ventura) { - if (checkKernelArgument("-crypt_allow_hash_validation")) { - SYSLOG(MODULE_SHORT, "disabling APFS.kext patching upon user request"); - } else { - lilu.onKextLoadForce(kextList, arrsize(kextList), - [](void *user, KernelPatcher &patcher, size_t index, mach_vm_address_t address, size_t size) { - processKext(patcher, index, address, size); - }, nullptr); - } - } + // Kernel Space Patcher + lilu.onKextLoadForce(kextList, arrsize(kextList), + [](void *user, KernelPatcher &patcher, size_t index, mach_vm_address_t address, size_t size) { + processKext(patcher, index, address, size); + }, nullptr); } // Boot args. static const char *bootargOff[] { - "-cryptoff" + "-terascaleoff" }; static const char *bootargDebug[] { - "-cryptdbg" + "-terascaledbg" }; static const char *bootargBeta[] { - "-cryptbeta" + "-terascalebeta" }; // Plugin configuration. @@ -147,7 +187,7 @@ PluginConfiguration ADDPR(config) { arrsize(bootargDebug), bootargBeta, arrsize(bootargBeta), - KernelVersion::BigSur, + KernelVersion::Lion, KernelVersion::Sonoma, pluginStart };