#

# ida_kernelcache/tagged_pointers.py

# Brandon Azad

#

"""ida_kernelcache.tagged_pointers

This module is responsible for processing the tagged pointers in the new iOS 12 kernelcache and

replacing them with their untagged equivalents. All found pointers are also converted into offsets.

In an alternative implementation, we could just add cross-references in IDA. However, I think this

approach is better because it is closer to what the kernelcache looks like at runtime.

"""

import idc

import idautils

import ida_utilities as idau

import kernel

_log = idau.make_log(1, __name__)

def tagged_pointer_tag(tp):

return (tp >> 48) & 0xffff

def tagged_pointer_untag(tp):

return tp | 0xffff000000000000

def is_tagged_pointer_format(value):

return tagged_pointer_tag(value) != 0xffff and \

(value & 0x0000ffff00000000) == 0x0000fff000000000

def is_tagged_pointer(value):

return is_tagged_pointer_format(value) and \

idau.is_mapped(tagged_pointer_untag(value), value=False)

def tagged_pointer_link(tag):

return (tag >> 1) & ~0x3

def tagged_pointer_next(ea, tp, end=None):

assert ea

# First try to get the offset to the next link.

if tp:

link_offset = tagged_pointer_link(tagged_pointer_tag(tp))

if link_offset:

return ea + link_offset

# Skip the current tagged pointer in preparation for scanning.

ea += idau.WORD_SIZE

# We don't have a link. Do a forward scan until we find the next tagged pointer.

_log(3, 'Scanning for next tagged pointer')

if end is None:

end = idc.SegEnd(ea)

for value, value_ea in idau.ReadWords(ea, end, step=4, addresses=True):

if is_tagged_pointer(value):

return value_ea

# If we didn't find any tagged pointers at all, return None.

return None

def untag_pointer(ea, tp):

_log(4, 'Untagging pointer at {:x}', ea)

idau.patch_word(ea, tagged_pointer_untag(tp))

idc.OpOff(ea, 0, 0)

def untag_pointers_in_range(start, end):

assert kernel.kernelcache_format == kernel.KC_12_MERGED, 'Wrong kernelcache format'

ea, tp = start, None

while True:

ea = tagged_pointer_next(ea, tp, end)

if ea is None or ea >= end:

break

tp = idau.read_word(ea)

if not is_tagged_pointer(tp):

_log(1, 'Tagged pointer traversal failed: ea={:x}, tp={:x}'.format(ea, tp))

break

untag_pointer(ea, tp)

def untag_pointers():

_log(2, 'Starting tagged pointer conversion')

for seg in idautils.Segments():

untag_pointers_in_range(idc.SegStart(seg), idc.SegEnd(seg))

_log(2, 'Tagged pointer conversion complete')