add standalone injector

arm64-injector-standalone/arm64-inject.h

@@ -0,0 +1,6 @@
+#pragma once
+
+#include <sys/types.h>
+#include <mach/error.h>
+
+extern kern_return_t inject(pid_t pid);

arm64-injector-standalone/extract.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# assemble
+as -o sa_arm64e.o sa_arm64e.s
+
+# calculate size and offset
+off=$(otool -l sa_arm64e.o | grep fileoff | sed 's/ fileoff //')
+siz=$(otool -l sa_arm64e.o | grep filesize | sed 's/ filesize //')
+
+# extract
+dd if=sa_arm64e.o of=sa_arm64e bs=1 count=$siz skip=$off &> /dev/null
+
+# build header
+xxd -i -a sa_arm64e sa_arm64e.h

arm64-injector-standalone/inject.c

@@ -0,0 +1,179 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <mach/mach.h>
+#include <mach/error.h>
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <pthread.h>
+#include <mach/mach_vm.h>
+
+#include <mach/arm/thread_status.h>
+#include <mach/arm/_structs.h>
+#include <ptrauth.h>
+
+#include "sa_arm64e.h"
+
+const uint64_t STACK_SIZE = 0x10000;
+const char *SA_POINTER_SENTINEL = "AAAAAAAA";
+
+static void fixup_shellcode() {
+ uint64_t pthread_set_self_ptr = (uint64_t)ptrauth_strip((void (*)(void))dlsym(RTLD_DEFAULT, "_pthread_set_self"), ptrauth_key_asia);
+ uint64_t pthread_create_from_mach_thread_ptr = (uint64_t)ptrauth_strip((void (*)(void))dlsym(RTLD_DEFAULT, "pthread_create_from_mach_thread"), ptrauth_key_asia);
+ uint64_t mach_thread_self_ptr = (uint64_t)ptrauth_strip((void (*)(void))mach_thread_self, ptrauth_key_asia);
+ uint64_t thread_suspend_ptr = (uint64_t)ptrauth_strip((void (*)(void))thread_suspend, ptrauth_key_asia);
+ uint64_t dlopen_ptr = (uint64_t)ptrauth_strip((void (*)(void))dlopen, ptrauth_key_asia);
+ uint64_t dlerror_ptr = (uint64_t)ptrauth_strip((void (*)(void))dlerror, ptrauth_key_asia);
+
+ unsigned char *pointers = memmem(sa_arm64e, sizeof(sa_arm64e), SA_POINTER_SENTINEL, strlen(SA_POINTER_SENTINEL));
+ if (!pointers) {
+ return;
+ }
+
+ memcpy(pointers, &pthread_set_self_ptr, sizeof(uint64_t));
+ pointers += sizeof(uint64_t);
+
+ memcpy(pointers, &pthread_create_from_mach_thread_ptr, sizeof(uint64_t));
+ pointers += sizeof(uint64_t);
+
+ memcpy(pointers, &mach_thread_self_ptr, sizeof(uint64_t));
+ pointers += sizeof(uint64_t);
+
+ memcpy(pointers, &thread_suspend_ptr, sizeof(uint64_t));
+ pointers += sizeof(uint64_t);
+
+ memcpy(pointers, &dlopen_ptr, sizeof(uint64_t));
+ pointers += sizeof(uint64_t);
+
+ memcpy(pointers, &dlerror_ptr, sizeof(uint64_t));
+}
+
+static kern_return_t inject_task(task_t dock) {
+ kern_return_t kr = KERN_SUCCESS;
+
+ mach_vm_address_t stack_region = 0;
+ mach_vm_address_t code_region = 0;
+
+ if ((kr = mach_vm_allocate(dock, &stack_region, STACK_SIZE, VM_FLAGS_ANYWHERE)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not allocate stack region\n");
+ return kr;
+ }
+
+ if ((kr = mach_vm_allocate(dock, &code_region, sizeof(sa_arm64e), VM_FLAGS_ANYWHERE)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not allocate code region\n");
+ return kr;
+ }
+
+ if ((kr = mach_vm_write(dock, code_region, (vm_address_t)sa_arm64e, sizeof(sa_arm64e))) != KERN_SUCCESS) {
+ fprintf(stderr, "could not write code region\n");
+ return kr;
+ }
+
+ if ((kr = vm_protect(dock, code_region, sizeof(sa_arm64e), FALSE, VM_PROT_READ | VM_PROT_EXECUTE)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not set permissions on code region\n");
+ return kr;
+ }
+
+ if ((kr = vm_protect(dock, stack_region, STACK_SIZE, TRUE, VM_PROT_READ | VM_PROT_WRITE)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not set permissions on stack region\n");
+ return kr;
+ }
+
+ struct arm_unified_thread_state thread_state = { };
+ struct arm_unified_thread_state machine_thread_state = { };
+
+ thread_state_flavor_t flavor = ARM_UNIFIED_THREAD_STATE;
+ mach_msg_type_number_t state_count = ARM_UNIFIED_THREAD_STATE_COUNT;
+ mach_msg_type_number_t machine_state_count = ARM_UNIFIED_THREAD_STATE_COUNT;
+
+ thread_act_t dock_thread = 0;
+
+ memset(&thread_state, 0, sizeof(thread_state));
+ memset(&machine_thread_state, 0, sizeof(machine_thread_state));
+
+ stack_region += STACK_SIZE >> 1;
+
+ thread_state.ash.flavor = ARM_THREAD_STATE64;
+ thread_state.ash.count = ARM_THREAD_STATE64_COUNT;
+
+ __darwin_arm_thread_state64_set_pc_fptr(
+ thread_state.ts_64,
+ ptrauth_sign_unauthenticated((void (*)(void))code_region, ptrauth_key_asia, 0)
+ );
+
+ __darwin_arm_thread_state64_set_sp(
+ thread_state.ts_64,
+ stack_region
+ );
+
+ if ((kr = thread_create(dock, &dock_thread)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not create thread: error %s\n", mach_error_string(kr));
+ return kr;
+ }
+
+ void *module = dlopen("/usr/lib/system/libsystem_kernel.dylib", RTLD_GLOBAL | RTLD_LAZY);
+ if (!module) {
+ fprintf(stderr, "could not load `libsystem_kernel.dylib`\n");
+ return KERN_FAILURE;
+ }
+
+ kern_return_t (*_thread_convert_thread_state)(
+ thread_act_t, int, thread_state_flavor_t, thread_state_t, mach_msg_type_number_t, thread_state_t, mach_msg_type_number_t *
+ ) = dlsym(module, "thread_convert_thread_state");
+
+ dlclose(module);
+
+ if (!_thread_convert_thread_state) {
+ fprintf(stderr, "could not get address of `thread_convert_thread_state`\n");
+ return KERN_FAILURE;
+ }
+
+ if ((kr = _thread_convert_thread_state(dock_thread, 2, flavor, (thread_state_t)&thread_state, state_count, (thread_state_t)&machine_thread_state, &machine_state_count)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not convert thread state: error %d %s\n", kr, mach_error_string(kr));
+ return kr;
+ }
+
+ if ((kr = thread_set_state(dock_thread, flavor, (thread_state_t)&machine_thread_state, machine_state_count)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not set thread state: error %s\n", mach_error_string(kr));
+ return kr;
+ }
+
+ if ((kr = thread_resume(dock_thread)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not start thread: error %s\n", mach_error_string(kr));
+ return kr;
+ }
+
+ mach_port_deallocate(mach_task_self(), dock_thread);
+
+ return kr;
+}
+
+kern_return_t inject(pid_t pid) {
+ task_t task;
+ kern_return_t kr = KERN_SUCCESS;
+
+ fixup_shellcode();
+
+ if ((kr = task_for_pid(mach_task_self(), pid, &task)) != KERN_SUCCESS) {
+ return kr;
+ }
+
+ if ((kr = inject_task(task)) != KERN_SUCCESS) {
+ fprintf(stderr, "could not perform injection into %d (Dock)\n", pid);
+ }
+
+ mach_port_deallocate(mach_task_self(), task);
+ return kr;
+}
+
+int main(int argc, char **argv) {
+ if (argc != 2) {
+ fprintf(stderr, "usage: %s <pid-of-dock>\n", argv[0]);
+ return KERN_FAILURE;
+ }
+
+ pid_t pid = atoi(argv[1]);
+ return inject(pid);
+}

arm64-injector-standalone/makefile

@@ -0,0 +1,9 @@
+all: sa_arm64e.h
+ clang -o inject inject.c -arch arm64e -std=c99 -Wall -DNDEBUG -O2 -fvisibility=hidden -mmacosx-version-min=10.13
+
+sa_arm64e.h:
+ ./extract.sh
+
+clean:
+ rm -f inject inject.o
+ rm -f sa_arm64e sa_arm64e.o sa_arm64e.h

arm64-injector-standalone/sa_arm64e.s

@@ -0,0 +1,68 @@
+.global _start
+.align 2
+
+_start:
+sub sp, sp, #0x20
+stp x29, x30, [sp, #0x10]
+add x29, sp, #10
+add x0, sp, #0x8
+
+adr x9, __pthread_set_self
+ldr x9, [x9]
+blr x9
+
+adr x2, _payload
+paciza x2
+
+add x0, sp, #0x8
+mov x1, #0
+mov x3, #0
+adr x9, _pthread_create_from_mach_thread
+ldr x9, [x9]
+blr x9
+
+adr x9, _mach_thread_self
+ldr x9, [x9]
+blr x9
+
+adr x9, _thread_suspend
+ldr x9, [x9]
+blr x9
+
+ldp x29, x30, [sp, #0x10]
+add sp, sp, #0x20
+ret
+
+_payload:
+pacibsp
+stp x29, x30, [sp, #-0x10]!
+mov x29, sp
+
+adr x0, _payload_path
+mov w1, #0x2
+adr x9, _dlopen
+ldr x9, [x9]
+blr x9
+
+cbnz x0, _payload_done
+
+adr x9, _dlerror
+ldr x9, [x9]
+blr x9
+
+_payload_done:
+mov x0, #0
+
+ldp x29, x30, [sp], #0x10
+retab
+
+; function pointers
+__pthread_set_self: .ascii "AAAAAAAA"
+_pthread_create_from_mach_thread: .ascii "BBBBBBBB"
+_mach_thread_self: .ascii "CCCCCCCC"
+_thread_suspend: .ascii "DDDDDDDD"
+_dlopen: .ascii "EEEEEEEE"
+_dlerror: .ascii "FFFFFFFF"
+
+; data
+_payload_path: .ascii "/Library/ScriptingAdditions/yabai.osax/Contents/Resources/payload.bundle/Contents/MacOS/payload\0"