Kext: Replace kernel functions

Codeaholic · Feb 19, 2013, 03:42 AM

Hi,

I've 'fixed' a bug in a XNU function. Now I'm looking for a way to apply this fix with a kernel module/kext. I can't be bothered to compile after every Apple update a new kernel with my fix. So I want to write a kext which replaces the old function with my function. I've done this for many times on Solaris and Linux but I'm a newbie in the XNU world.

I guess all what I need is a way (example code that works would be helpful!) to access the kernel symbol address table. With the address of the old function I should be able to patch a Jump into the function that points to my new function. Very evil, I know.

Does somebody did something like this? Please let me know, if you have any idea.

Madd the Sane · Feb 19, 2013, 11:59 AM

If you've found a bug in the kernel, file a bug report at bugreport.apple.com, as well as post the patch on Apple's kernel mailing list.

Codeaholic · Feb 20, 2013, 12:57 AM

Quote:

Originally Posted by Madd the Sane

If you've found a bug in the kernel, file a bug report at bugreport.apple.com, as well as post the patch on Apple's kernel mailing list.

Yes, but first I want to check my fix with a kext. I guess it would be a nice exercise as well.

Does somebody has an idea?

Codeaholic · Feb 21, 2013, 01:03 AM

After lots of googling, I've found one paper which has some interesting approaches: http://defcon.org/images/defcon-17/d...ing_on_osx.pdf

It's mainly written for patching syscalls but that's ok. It should also work for functions.

Anyway, any other information regarding this topic would be nice.

Feb 19, 2013, 03:42 AM	#1
Codeaholic macrumors newbie Join Date: Aug 2011	Kext: Replace kernel functions Hi, I've 'fixed' a bug in a XNU function. Now I'm looking for a way to apply this fix with a kernel module/kext. I can't be bothered to compile after every Apple update a new kernel with my fix. So I want to write a kext which replaces the old function with my function. I've done this for many times on Solaris and Linux but I'm a newbie in the XNU world. I guess all what I need is a way (example code that works would be helpful!) to access the kernel symbol address table. With the address of the old function I should be able to patch a Jump into the function that points to my new function. Very evil, I know. Does somebody did something like this? Please let me know, if you have any idea.
	0

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Feb 19, 2013, 11:59 AM	#2
Madd the Sane macrumors 6502 Join Date: Nov 2010 Location: Utah	If you've found a bug in the kernel, file a bug report at bugreport.apple.com, as well as post the patch on Apple's kernel mailing list.
	0

Feb 21, 2013, 01:03 AM	#4
Codeaholic Thread Starter macrumors newbie Join Date: Aug 2011	After lots of googling, I've found one paper which has some interesting approaches: http://defcon.org/images/defcon-17/d...ing_on_osx.pdf It's mainly written for patching syscalls but that's ok. It should also work for functions. Anyway, any other information regarding this topic would be nice.
	0


MacRumors Forums > Apple Systems and Services > Programming > Mac Programming