I and one other person are working on Kernel Collections support in Ozmosis but we have a problem it doesn’t find Kernel Collections symbols for some reason I suspect the problem is in this part of the code can anyone help?
if (MachOInfo->Is64Bit) {
struct nlist_64 *nlist64 = NULL;
nlist64 = PTR_OFFSET(MachOInfo->LinkEditAddress, (symtabCommand->symoff - MachOInfo->LinkEditOffset) + MachOInfo->RelocBase, struct nlist_64 *);
// Iterate the x86_64 Symbol List
while (symbolIndex < symtabCommand->nsyms) {
MachOUpdateSymbol (MachOInfo,
symbolString + nlist64->n_un.n_strx,
(UINT32)nlist64->n_value);
symbolIndex++;
nlist64++;
}
} else {
struct nlist *nlist = PTR_OFFSET(MachOInfo->LinkEditAddress, (symtabCommand->symoff - MachOInfo->LinkEditOffset) + MachOInfo->RelocBase, struct nlist *);
// Iterate the i386 Symbol List
while (symbolIndex < symtabCommand->nsyms) {
MachOUpdateSymbol (MachOInfo,
symbolString + nlist->n_un.n_strx,
nlist->n_value);
symbolIndex++;
nlist++;
}
}
BDMESG logs:
08:521 00:004 Found Mach-O Image 0x26600000 Magic 0xFEEDFACF (64 Bit)
08:526 00:004 Registered "__TEXT","__text" section - Success
08:533 00:006 Registered "__PRELINK_TEXT","__text" section - Success
08:539 00:006 Registered "__PRELINK_INFO","__info" section - Success
08:545 00:006 Registered "_version_major" symbol - Success
08:550 00:005 Registered "_version_minor" symbol - Success
08:557 00:006 Registered "_version_revision" symbol - Success
08:563 00:006 Registered "_version" symbol - Success
08:568 00:005 Registered "_panic" symbol - Success
08:573 00:004 MachKernelCommPagePanicPatcher: Registered
08:578 00:004 Registered "_cpuid_set_info" symbol - Success
08:585 00:006 Registered "_cpuid_family" symbol - Success
08:589 00:004 MachKernelCpuIdPatcher: Registered
08:594 00:004 ReadStartupExtensionsPatches: Allowed
08:598 00:004 Registered "_getsegbyname" symbol - Success
08:603 00:004 Registered "_OSKextLog" symbol - Success
08:610 00:006 Registered "__ZN12KLDBootstrap20readBooterExtensionsEv" symbol - Success
08:614 00:004 Registered "__ZN12KLDBootstrap23readPrelinkedExtensionsEP7section" symbol - Success
08:619 00:004 Registered "__ZN12KLDBootstrap23readPrelinkedExtensionsEP10section_64" symbol - Success
08:626 00:006 MachKernelReadStartupExtensionsPatcher: Registered
08:630 00:004 LoadExecutablePatches: Allowed
08:635 00:004 Registered "__ZN6OSKext14loadExecutableEv" symbol - Success
08:642 00:006 Registered "_IOTaskHasEntitlement" symbol - Success
08:646 00:004 MachKernelNotEntitledToLinkKextPatcher: Registered
08:651 00:004 Registered "__ZN12IOUserClient21copyClientEntitlementEP4taskPKc" symbol - Success
08:655 00:004 MachKernelMOJANotEntitledToLinkKextPatcher: Registered
08:664 00:008 MachKernelHSNotEntitledToLinkKextPatcher: Registered
08:669 00:005 Registered "__ZN6OSKext19removeKextBootstrapEv" symbol - Success
08:675 00:005 MachKernelKxldPatcher: Registered
08:680 00:005 Registered "__ZN6OSKext19printKextPanicListsEPFiPKczE" symbol - Success
08:687 00:007 MachKernelPanicNoKextDumpPatcher: Registered
08:693 00:005 Found Mach-O Image 0x26600000 Magic 0xFEEDFACF (64 Bit) 669 Load Commands
08:698 00:005 Parsing 669 Load Commands
08:705 00:007 0x26600020 LC_UUID cmdsize 0x0018 0FD9167B-6E34-04D4-2FFE-AAEEF1987306
08:710 00:005 0x26600050 LC_UNIXTHREAD cmdsize 0x00B8 (x86_64) rip 0x00100000
08:715 00:005 0x26600108 LC_SYMTAB cmdsize 0x0018 symoff 0x00000000 nsyms 0x0000 stroff 0x00000000 strsize 0x00000000
08:722 00:006 __text addr 0x20C000 size 0x000000 offset 0x00C000 align 0x0 reloff 0x0 nreloc 0x80000400 flags 0x000002
08:727 00:005 Updated Section "__PRELINK_TEXT","__text" = 0x20C000, 0xC000, 0x0
08:733 00:005 __info addr 0xC4C000 size 0x3A0000 offset 0xA4C000 align 0x0 reloff 0x0 nreloc 0x00000000 flags 0x000002
08:740 00:006 Updated Section "__PRELINK_INFO","__info" = 0xC4C000, 0xA4C000, 0x3A0000
08:745 00:005 __text addr 0x100000 size 0x0A0000 offset 0x1078000 align 0x0 reloff 0x0 nreloc 0x00000400 flags 0x000002
08:752 00:006 Debug: After parsing Load Commands
08:757 00:005 64 Bit MachO
08:763 00:005 Parsed -1 Symbols
08:768 00:005 <null string> 0.0.0
08:773 00:005 Found <null string> 0x26600000 Kernelcache
08:780 00:007 Kernel Patches started
08:785 00:005 MachKernelReadStartupExtensionsPatcher: Started
08:791 00:005 Invalid Param
08:796 00:005 Kernel Patches finished
We haven’t tried anything yet because we can’t figure out what the problem is.
New contributor
kkamish is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.