#
# ida_kernelcache/segment.py
# Brandon Azad
#
# Functions for interacting with the segments of the kernelcache in IDA. No prior initialization is
# necessary.
#
import idc
import ida_utilities as idau
import kernel
_log = idau.make_log(0, __name__)
idc.Til2Idb(-1, 'mach_header_64')
idc.Til2Idb(-1, 'load_command')
idc.Til2Idb(-1, 'segment_command_64')
idc.Til2Idb(-1, 'section_64')
_LC_SEGMENT_64 = 0x19
def _macho_segments_and_sections(ea):
"""A generator to iterate through a Mach-O file's segments and sections.
Each iteration yields a tuple:
(segname, segstart, segend, [(sectname, sectstart, sectend), ...])
"""
hdr = idau.read_struct(ea, 'mach_header_64', asobject=True)
nlc = hdr.ncmds
lc = int(hdr) + len(hdr)
lcend = lc + hdr.sizeofcmds
while lc < lcend and nlc > 0:
loadcmd = idau.read_struct(lc, 'load_command', asobject=True)
if loadcmd.cmd == _LC_SEGMENT_64:
segcmd = idau.read_struct(lc, 'segment_command_64', asobject=True)
segname = idau.null_terminated(segcmd.segname)
segstart = segcmd.vmaddr
segend = segstart + segcmd.vmsize
sects = []
sc = int(segcmd) + len(segcmd)
for i in range(segcmd.nsects):
sect = idau.read_struct(sc, 'section_64', asobject=True)
sectname = idau.null_terminated(sect.sectname)
sectstart = sect.addr
sectend = sectstart + sect.size
sects.append((sectname, sectstart, sectend))
sc += len(sect)
yield (segname, segstart, segend, sects)
lc += loadcmd.cmdsize
nlc -= 1
def _initialize_segments_in_kext(kext, mach_header, skip=[]):
"""Rename the segments in the specified kext."""
def log_seg(segname, segstart, segend):
_log(3, '+ segment {: <20} {:x} - {:x} ({:x})', segname, segstart, segend,
segend - segstart)
def log_sect(sectname, sectstart, sectend):
_log(3, ' section {: <20} {:x} - {:x} ({:x})', sectname, sectstart, sectend,
sectend - sectstart)
def log_gap(gapno, start, end, mapped):
mapped = 'mapped' if mapped else 'unmapped'
_log(3, ' gap {: <20} {:x} - {:x} ({:x}, {})', gapno, start, end,
end - start, mapped)
def process_region(segname, name, start, end):
assert end >= start
if segname in skip:
_log(2, 'Skipping segment {}', segname)
return
newname = '{}.{}'.format(segname, name)
if kext:
newname = '{}:{}'.format(kext, newname)
if start == end:
_log(2, 'Skipping empty region {} at {:x}', newname, start)
return
ida_segstart = idc.SegStart(start)
if ida_segstart == idc.BADADDR:
_log(0, "IDA doesn't think this is a real segment: {:x} - {:x}", start, end)
return
ida_segend = idc.SegEnd(ida_segstart)
if start != ida_segstart or end != ida_segend:
_log(0, 'IDA thinks segment {} {:x} - {:x} should be {:x} - {:x}', newname, start, end,
ida_segstart, ida_segend)
return
_log(2, 'Rename {:x} - {:x}: {} -> {}', start, end, idc.SegName(start), newname)
idc.SegRename(start, newname)
def process_gap(segname, gapno, start, end):
mapped = idau.is_mapped(start)
log_gap(gapno, start, end, mapped)
if mapped:
name = 'HEADER' if start == mach_header else '__gap_' + str(gapno)
process_region(segname, name, start, end)
for segname, segstart, segend, sects in _macho_segments_and_sections(mach_header):
log_seg(segname, segstart, segend)
lastend = segstart
gapno = 0
for sectname, sectstart, sectend in sects:
if lastend < sectstart:
process_gap(segname, gapno, lastend, sectstart)
gapno += 1
log_sect(sectname, sectstart, sectend)
process_region(segname, sectname, sectstart, sectend)
lastend = sectend
if lastend < segend:
process_gap(segname, gapno, lastend, segend)
gapno += 1
def initialize_segments():
"""Rename the kernelcache segments in IDA according to the __PRELINK_INFO data.
Rename the kernelcache segments based on the contents of the __PRELINK_INFO dictionary.
Segments are renamed according to the scheme '[<kext>:]<segment>.<section>', where '<kext>' is
the bundle identifier if the segment is part of a kernel extension. The special region
containing the Mach-O header is renamed '[<kext>:]<segment>.HEADER'.
"""
# First rename the kernel segments.
_log(1, 'Renaming kernel segments')
kernel_skip = ['__PRELINK_TEXT', '__PLK_TEXT_EXEC', '__PRELINK_DATA', '__PLK_DATA_CONST']
_initialize_segments_in_kext(None, kernel.base, skip=kernel_skip)
# Process each kext identified by the __PRELINK_INFO. In the new kernelcache format 12-merged,
# the _PrelinkExecutableLoadAddr key is missing for all kexts, so no extra segment renaming
# takes place.
prelink_info_dicts = kernel.prelink_info['_PrelinkInfoDictionary']
for kext_prelink_info in prelink_info_dicts:
kext = kext_prelink_info.get('CFBundleIdentifier', None)
mach_header = kext_prelink_info.get('_PrelinkExecutableLoadAddr', None)
if kext is not None and mach_header is not None:
orig_kext = idc.SegName(mach_header).split(':', 1)[0]
if '.kpi.' not in kext and orig_kext != kext:
_log(0, 'Renaming kext {} -> {}', orig_kext, kext)
_log(1, 'Renaming segments in {}', kext)
_initialize_segments_in_kext(kext, mach_header)
_kext_regions = []
def _initialize_kext_regions():
"""Get region information for each kext based on iOS 12's __PRELINK_INFO.__kmod_start.
NOTE: This only accounts for __TEXT_EXEC, not the other segments."""
kmod_start = idc.SegByBase(idc.SegByName('__PRELINK_INFO.__kmod_start'))
if kmod_start == idc.BADADDR:
return
for kmod in idau.ReadWords(kmod_start, idc.SegEnd(kmod_start)):
_log(1, 'Found kmod {:x}', kmod)
segments = list(_macho_segments_and_sections(kmod))
if len(segments) != 1:
_log(0, 'Skipping unrecognized kmod {:x}', kmod)
continue
segname, segstart, segend, sects = segments[0]
if segname != '__TEXT_EXEC' or len(sects) != 1:
_log(0, 'Skipping unrecognized kmod {:x}', kmod)
continue
kmod_name = 'kext.{:x}'.format(kmod)
_log(1, 'Adding module: {:x} - {:x} {}', segstart, segend, kmod_name)
_kext_regions.append((segstart, segend, kmod_name))
_initialize_kext_regions()
def kernelcache_kext(ea):
"""Return the name of the kext to which the given linear address belongs.
Only works if segments have been renamed using initialize_segments().
NOTE: Kexts are not well distinguished on the new iOS 12 merged kernelcache format. Do not rely
on this function.
"""
# TODO: This doesn't work on 12-merged kernelcaches!
name = idc.SegName(ea) or ''
if ':' in name:
return idc.SegName(ea).split(':', 1)[0]
if _kext_regions:
for start, end, kext in _kext_regions:
if start <= ea < end:
return kext
return None
