I'm working on pattern searching in OS X for my releases of ProbablyEngine.
Here is the code I've got now, its incredibly slow....
Code:
/*
*
* Author: Grant Douglas (@Hexploitable)
*
*/
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <mach/vm_map.h>
#include <mach-o/dyld_images.h>
int pid = 0;
int g_pid = 0;
#define sigSize 4 //Number of bytes used in signature
mach_vm_address_t *scanMem(int pid, mach_vm_address_t addr, mach_msg_type_number_t size)
{
task_t t;
task_for_pid(mach_task_self(), pid, &t);
mach_msg_type_number_t dataCnt = size;
mach_vm_address_t max = addr + size;
int bytesRead = 0;
kern_return_t kr_val;
pointer_t buf;
uint32_t sz;
//Method signature - taken from disassembler
unsigned char signature[sigSize] = "\x74\x69\x83\xf9";
unsigned char buffer[sigSize];
while (bytesRead < size)
{
if ((kr_val = vm_read(t, addr, sigSize, &buf, &sz)) == KERN_SUCCESS)
{
memcpy(buffer, (const void *)buf, sigSize);
if (memcmp(buffer, signature, sigSize) == 0)
{
fflush(stdout);
return (unsigned long long *)addr;
}
else
printf("[-] %p ---> vm_read()\r", addr);
fflush(stdout);
//usleep(50);
}
else
{
printf("[-] %p ---> vm_read().\r", addr);
fflush(stdout);
}
addr += sizeof(unsigned char);
bytesRead += sizeof(unsigned char);
}
printf("[i] Scanning ended without a match.\r\n");
fflush(stdout);
return NULL;
}
unsigned int *getMemRegions(task_t task, vm_address_t address)
{
kern_return_t kret;
vm_region_basic_info_data_t info;
vm_size_t size;
mach_port_t object_name;
mach_msg_type_number_t count;
vm_address_t firstRegionBegin;
vm_address_t lastRegionEnd;
vm_size_t fullSize;
count = VM_REGION_BASIC_INFO_COUNT_64;
int regionCount = 0;
int flag = 0;
while (flag == 0)
{
//Attempts to get the region info for given task
kret = mach_vm_region(task, &address, &size, VM_REGION_BASIC_INFO, (vm_region_info_t) &info, &count, &object_name);
if (kret == KERN_SUCCESS)
{
if (regionCount == 0)
{
firstRegionBegin = address;
regionCount += 1;
}
fullSize += size;
address += size;
}
else
flag = 1;
}
lastRegionEnd = address;
printf("[+] Region to scan: %p - %p\n", firstRegionBegin, lastRegionEnd);
unsigned int *ptrToFunc = (unsigned int *)scanMem(pid, firstRegionBegin, fullSize);
return ptrToFunc;
}
int main() {
kern_return_t rc;
mach_port_t task;
mach_vm_address_t addr = 1;
printf("[+] Please specify the pid of target process.\n");
scanf("%d", &pid);
g_pid = pid;
rc = task_for_pid(mach_task_self(), pid, &task);
if (rc)
{
fprintf(stderr, "[-] task_for_pid() failed, error %d - %s", rc, mach_error_string(rc));
exit(1);
}
printf("[i] RC %d ---> Task %d\n\n", rc, task);
unsigned int *sym = getMemRegions(task, addr);
if (sym != NULL)
printf("[$] Located target function ---> %p\n", sym);
else
printf("[-] Didn\'t find the function.\n");
return 0;
}
I've returned the code to its original version with comments and verbose output, even with the extra bits removed, its way too slow. Does anyone have any experience working with this on OS X?