/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp

Bug Summary

File:	TinyInst/macOS/debugger.cpp
Warning:	line 1765, column 3 MIG callback fails with error after deallocating argument value. This is a use-after-free vulnerability because the caller will try to deallocate it again
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple arm64-apple-macosx14.2.0 -Wundef-prefix=TARGET_OS_ -Werror=undef-prefix -Wdeprecated-objc-isa-usage -Werror=deprecated-objc-isa-usage -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name debugger.cpp -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=osx -analyzer-checker=security.insecureAPI.decodeValueOfObjCType -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mframe-pointer=non-leaf -ffp-contract=on -fno-rounding-math -funwind-tables=1 -target-sdk-version=14.2 -fcompatibility-qualified-id-block-type-checking -fvisibility-inlines-hidden-static-local-var -target-cpu apple-m1 -target-feature +v8.5a -target-feature +aes -target-feature +crc -target-feature +dotprod -target-feature +fp-armv8 -target-feature +fp16fml -target-feature +lse -target-feature +ras -target-feature +rcpc -target-feature +rdm -target-feature +sha2 -target-feature +sha3 -target-feature +neon -target-feature +zcm -target-feature +zcz -target-feature +fullfp16 -target-abi darwinpcs -debugger-tuning=lldb -target-linker-version 1022.1 -fcoverage-compilation-dir=/Users/xss/tmp/Jackalope-main -resource-dir /opt/homebrew/Cellar/llvm/17.0.6_1/lib/clang/17 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk -D CMAKE_INTDIR="Debug" -D ARM64 -I /Users/xss/tmp/Jackalope-main/TinyInst/Debug/include -I /Users/xss/tmp/Jackalope-main/TinyInst/third_party/obj/wkit/include -I /Users/xss/tmp/Jackalope-main/TinyInst -I /Users/xss/tmp/Jackalope-main/TinyInst/third_party/reil -I /Users/xss/tmp/Jackalope-main/build/tinyinst.build/Debug/DerivedSources-normal/arm64 -I /Users/xss/tmp/Jackalope-main/build/tinyinst.build/Debug/DerivedSources/arm64 -I /Users/xss/tmp/Jackalope-main/build/tinyinst.build/Debug/DerivedSources -F/Users/xss/tmp/Jackalope-main/TinyInst/Debug -internal-isystem /opt/homebrew/Cellar/llvm/17.0.6_1/bin/../include/c++/v1 -internal-isystem /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk/usr/local/include -internal-isystem /opt/homebrew/Cellar/llvm/17.0.6_1/lib/clang/17/include -internal-externc-isystem /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk/usr/include -O0 -Wno-trigraphs -Wno-missing-field-initializers -Wno-missing-prototypes -Wno-return-type -Wno-non-virtual-dtor -Wno-overloaded-virtual -Wno-exit-time-destructors -Wno-missing-braces -Wno-unused-function -Wno-unused-label -Wno-unused-parameter -Wno-unused-variable -Wno-empty-body -Wno-uninitialized -Wno-unknown-pragmas -Wno-shadow -Wno-four-char-constants -Wno-conversion -Wno-constant-conversion -Wno-int-conversion -Wno-bool-conversion -Wno-enum-conversion -Wno-float-conversion -Wno-non-literal-null-conversion -Wno-objc-literal-conversion -Wno-newline-eof -Wno-c++11-extensions -Wno-implicit-fallthrough -Wno-sign-conversion -Wno-infinite-recursion -Wno-move -Wno-comma -Wno-block-capture-autoreleasing -Wno-strict-prototypes -Wno-range-loop-analysis -Wno-semicolon-before-method-body -std=gnu++17 -fdeprecated-macro -fdebug-compilation-dir=/Users/xss/tmp/Jackalope-main -ferror-limit 19 -fmacro-backtrace-limit=0 -fmessage-length=260 -stack-protector 1 -fblocks -fencode-extended-block-signature -fregister-global-dtors-with-atexit -fgnuc-version=4.2.1 -fcxx-exceptions -fexceptions -fpascal-strings -fmax-type-align=16 -fdiagnostics-show-note-include-stack -fcolor-diagnostics -analyzer-output=html -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /Users/xss/tmp/Jackalope-main/report/2024-02-26-100845-33878-1 -x c++ /Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp
1/*
2Copyright 2020 Google LLC

4Licensed under the Apache License, Version 2.0 (the "License");
5you may not use this file except in compliance with the License.
6You may obtain a copy of the License at

8https ://www.apache.org/licenses/LICENSE-2.0

10Unless required by applicable law or agreed to in writing, software
11distributed under the License is distributed on an "AS IS" BASIS,
12WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13See the License for the specific language governing permissions and
14limitations under the License.
15*/

17#include <cstdio>
18#include <cstdlib>
19#include <string>
20#include <thread>
21#include <algorithm>

23#include <mach/mach.h>
24#include <mach/mach_vm.h>

26#include <mach-o/dyld.h>
27#include <mach-o/dyld_images.h>
28#include <mach-o/nlist.h>

30#include <dlfcn.h>

32#include <spawn.h>
33#include <sys/types.h>
34#include <sys/ptrace.h>
35#include <signal.h>
36#include <fcntl.h>

38#include "macOS/debugger.h"
39#include "common.h"

41#define BREAKPOINT_UNKNOWN0x0 0x0
42#define BREAKPOINT_ENTRYPOINT0x01 0x01
43#define BREAKPOINT_TARGET0x02 0x02
44#define BREAKPOINT_NOTIFICATION0x04 0x04
45#define BREAKPOINT_TARGET_END0x08 0x08

47#define PERSIST_END_EXCEPTION0x0F22 0x0F22

49#ifndef _POSIX_SPAWN_DISABLE_ASLR0x0100
#define _POSIX_SPAWN_DISABLE_ASLR0x0100 0x0100
51#endif

53extern char **environ;

55std::unordered_map<task_t, class Debugger*> Debugger::task_to_debugger_map;
56std::mutex Debugger::map_mutex;

58vm_prot_t Debugger::MacOSProtectionFlags(MemoryProtection memory_protection) {
switch (memory_protection) {
  case READONLY:
    return VM_PROT_READ((vm_prot_t) 0x01);

  case READWRITE:
    return VM_PROT_READ((vm_prot_t) 0x01) | VM_PROT_WRITE((vm_prot_t) 0x02);

  case READEXECUTE:
    return VM_PROT_READ((vm_prot_t) 0x01) | VM_PROT_EXECUTE((vm_prot_t) 0x04);

  case READWRITEEXECUTE:
    return VM_PROT_ALL(((vm_prot_t) 0x01)|((vm_prot_t) 0x02)|((vm_prot_t) 0x04));

  default:
    FATAL("Unimplemented memory protection")do { printf("[-] PROGRAM ABORT : " "Unimplemented memory protection"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 73); exit(1); } while (0);
}
75}

77void Debugger::ClearSharedMemory() {
for (auto iter = shared_memory.begin(); iter != shared_memory.end(); ) {
  iter = FreeSharedMemory(iter);
}

shared_memory.clear();
83}

85std::list<SharedMemory>::iterator Debugger::FreeSharedMemory(std::list<SharedMemory>::iterator it) {
if (it->size == 0) {
  WARN("FreeShare is called with size == 0\n")do { printf("[!] WARNING: " "FreeShare is called with size == 0\n"
); printf("\n"); } while (0);
  return ++it;
}

kern_return_t krt = mach_port_destroy(mach_task_self()mach_task_self_, it->port);
if (krt != KERN_SUCCESS0) {
  FATAL("Error (%s) destroy port for local shared memory @ 0x%llx\n", mach_error_string(krt), it->local_address)do { printf("[-] PROGRAM ABORT : " "Error (%s) destroy port for local shared memory @ 0x%llx\n"
, mach_error_string(krt), it->local_address); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 93); exit(1); } while (0);
}

krt = mach_vm_deallocate(mach_task_self()mach_task_self_, it->local_address, it->size);
if (krt != KERN_SUCCESS0) {
  FATAL("Error (%s) freeing memory @ 0x%llx\n", mach_error_string(krt), it->remote_address)do { printf("[-] PROGRAM ABORT : " "Error (%s) freeing memory @ 0x%llx\n"
, mach_error_string(krt), it->remote_address); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 98); exit(1); } while (0);
}

return shared_memory.erase(it);
102}

104void Debugger::RemoteFree(void *address, size_t size) {
for (auto iter = shared_memory.begin(); iter != shared_memory.end(); iter++) {
  if (iter->remote_address == (mach_vm_address_t)address) {
    FreeSharedMemory(iter);
    break;
  }
}
mach_target->FreeMemory((uint64_t)address, size);
112}

114void Debugger::RemoteRead(void *address, void *buffer, size_t size) {
mach_vm_address_t shared_memory_address = 0;
for (auto iter = shared_memory.begin(); iter != shared_memory.end(); ++iter) {
  if (((mach_vm_address_t)address >= iter->remote_address)  &&
      (((mach_vm_address_t)address + size) <= (iter->remote_address + iter->size)))
  {
    shared_memory_address = iter->local_address + ((mach_vm_address_t)address - iter->remote_address);
    break;
  }
}

if (shared_memory_address) {
  memcpy(buffer, (void *)shared_memory_address, size);
} else {
  mach_target->ReadMemory((uint64_t)address, size, buffer);
}
130}

132void Debugger::RemoteWrite(void *address, const void *buffer, size_t size) {
mach_target->WriteMemory((uint64_t)address, buffer, size);
134}

136void Debugger::RemoteProtect(void *address, size_t size, MemoryProtection protect) {
RemoteProtect(address, size, MacOSProtectionFlags(protect));
138}

140void Debugger::RemoteProtect(void *address, size_t size, vm_prot_t protect) {
mach_target->ProtectMemory((uint64_t)address, size, protect);
142}

144void Debugger::CreateException(MachException *mach_exception, Exception *exception) {
exception->ip = (void*)GetRegister(ARCH_PCPC);

switch (mach_exception->exception_type) {
  case EXC_BREAKPOINT6:
    exception->type = BREAKPOINT;
150#ifdef ARM641
    SetRegister(ARCH_PCPC, GetRegister(ARCH_PCPC) + 4);
    exception->ip = (void*)((uint64_t)exception->ip);
153#else
    exception->ip = (void*)((uint64_t)exception->ip - 1);
155#endif
    break;

  case EXC_BAD_ACCESS1:
    exception->type = ACCESS_VIOLATION;
    break;

  case EXC_BAD_INSTRUCTION2:
    exception->type = ILLEGAL_INSTRUCTION;
    break;

  default:
    exception->type = OTHER;
    break;
}

exception->maybe_execute_violation = false;
exception->maybe_write_violation = false;
exception->access_address = 0;

if (mach_exception->exception_type == EXC_BAD_ACCESS1) {
  if (mach_exception->code[0] == KERN_PROTECTION_FAILURE2) {
    exception->maybe_write_violation = true;
    exception->maybe_execute_violation = true;
  }

  exception->access_address = (void*)mach_exception->code[1];
}
183}

185uint64_t* Debugger::GetPointerToRegister(Register r) {
ARCH_THREAD_STATE_Tarm_thread_state64_t *state = (ARCH_THREAD_STATE_Tarm_thread_state64_t*)(mach_exception->new_state);
187#ifdef ARM641
switch(r) {
  case X0:
  case X1:
  case X2:
  case X3:
  case X4:
  case X5:
  case X6:
  case X7:
  case X8:
  case X9:
  case X10:
  case X11:
  case X12:
  case X13:
  case X14:
  case X15:
  case X16:
  case X17:
  case X18:
  case X19:
  case X20:
  case X21:
  case X22:
  case X23:
  case X24:
  case X25:
  case X26:
  case X27:
  case X28:
  case X29:
    return &state->__x[r];
  case PC:
    return &state->__pc;
  case CPSR:
    return (uint64_t*)&state->__cpsr;
  case LR:
    return &state->__lr;
  case SP:
    return &state->__sp;

  default:
    FATAL("Unimplemented register")do { printf("[-] PROGRAM ABORT : " "Unimplemented register");
 printf("         Location : %s(), %s:%u\n\n", __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 230); exit(1); } while (0);
  }
232#else
switch (r) {
  case RAX:
    return &state->__rax;
  case RCX:
    return &state->__rcx;
  case RDX:
    return &state->__rdx;
  case RBX:
    return &state->__rbx;
  case RSP:
    return &state->__rsp;
  case RBP:
    return &state->__rbp;
  case RSI:
    return &state->__rsi;
  case RDI:
    return &state->__rdi;
  case R8:
    return &state->__r8;
  case R9:
    return &state->__r9;
  case R10:
    return &state->__r10;
  case R11:
    return &state->__r11;
  case R12:
    return &state->__r12;
  case R13:
    return &state->__r13;
  case R14:
    return &state->__r14;
  case R15:
    return &state->__r15;
  case RIP:
    return &state->__rip;

  default:
    FATAL("Unimplemented register")do { printf("[-] PROGRAM ABORT : " "Unimplemented register");
 printf("         Location : %s(), %s:%u\n\n", __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 270); exit(1); } while (0);
}
272#endif
273}

275size_t Debugger::GetRegister(Register r) {
276#ifdef ARM641
if (r == CPSR) {
  uint32_t *reg_pointer = (uint32_t *)GetPointerToRegister(r);
  return *reg_pointer;
}
281#endif
uint64_t *reg_pointer = GetPointerToRegister(r);
return *reg_pointer;
284}

286void Debugger::SetRegister(Register r, size_t value) {
287#ifdef ARM641
if (r == CPSR) {
  if(value & 0xFFFFFFFF00000000) FATAL("32 bit value required")do { printf("[-] PROGRAM ABORT : " "32 bit value required"); printf
("         Location : %s(), %s:%u\n\n", __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 289); exit(1); } while (0);
  uint32_t *reg_pointer = (uint32_t *)GetPointerToRegister(r);
  *reg_pointer = (uint32_t)(value & 0xFFFFFFFF);
}
293#endif
uint64_t *reg_pointer = GetPointerToRegister(r);
*reg_pointer = value;
296}

298#ifdef ARM641
299Register Debugger::ArgumentToRegister(int arg) {
switch (arg) {
  case 0:
    return X0;

  case 1:
    return X1;

  case 2:
    return X2;

  case 3:
    return X3;

  case 4:
    return X4;

  case 5:
    return X5;

  case 6:
    return X6;

  case 7:
    return X7;

  default:
    FATAL("Argument %d not valid\n", arg)do { printf("[-] PROGRAM ABORT : " "Argument %d not valid\n",
 arg); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 326); exit(1); } while (0);
    break;
}
329}
330#else
331Register Debugger::ArgumentToRegister(int arg) {
switch (arg) {
  case 0:
    return RDI;

  case 1:
    return RSI;

  case 2:
    return RDX;

  case 3:
    return RCX;

  case 4:
    return R8;

  case 5:
    return R9;

  default:
    FATAL("Argument %d not valid\n", arg)do { printf("[-] PROGRAM ABORT : " "Argument %d not valid\n",
 arg); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 352); exit(1); } while (0);
    break;
}
355}
356#endif

358void Debugger::SetReturnAddress(size_t value) {
359#ifdef ARM641 
SetRegister(LR, value);
361#else
RemoteWrite((void*)GetRegister(RSP), &value, child_ptr_size);
363#endif
364}

366size_t Debugger::GetReturnAddress() {
367#ifdef ARM641 
return GetRegister(LR);
369#else
void *ra;
RemoteRead((void*)GetRegister(RSP), &ra, child_ptr_size);
return (size_t)ra;
373#endif
374}

376void Debugger::GetMachHeader(void *mach_header_address, mach_header_64 *mach_header) {
RemoteRead(mach_header_address, (void*)mach_header, sizeof(mach_header_64));
378}

380void Debugger::GetLoadCommandsBuffer(void *mach_header_address,
                                   const mach_header_64 *mach_header,
                                   void **load_commands) {
*load_commands = (void*)malloc(mach_header->sizeofcmds);
RemoteRead((void*)((uint64_t)mach_header_address + sizeof(mach_header_64)),
           *load_commands,
           mach_header->sizeofcmds);
387}

389template <class TCMD>
390bool Debugger::GetLoadCommand(mach_header_64 mach_header,
                            void *load_commands_buffer,
                            uint32_t load_cmd_type,
                            const char *segname,
                            TCMD **ret_command) {
uint64_t load_cmd_addr = (uint64_t)load_commands_buffer;
for (uint32_t i = 0; i < mach_header.ncmds; ++i) {
  load_command *load_cmd = (load_command *)load_cmd_addr;
  if (load_cmd->cmd == load_cmd_type) {
    TCMD *t_cmd = (TCMD*)load_cmd;
    if (load_cmd_type != LC_SEGMENT_640x19
        || !strcmp(((segment_command_64*)t_cmd)->segname, segname)) {
      *ret_command = (TCMD*)load_cmd;
      return true;
    }
  }

  load_cmd_addr += load_cmd->cmdsize;
}

return false;
411}


414bool Debugger::GetSectionAndSlide(void *mach_header_address,
                               const char *segname,
                               const char *sectname,
                               section_64 *ret_section,
                               size_t *file_vm_slide) {
mach_header_64 mach_header;
GetMachHeader(mach_header_address, &mach_header);

void *load_commands_buffer = NULL__null;
GetLoadCommandsBuffer(mach_header_address, &mach_header, &load_commands_buffer);

segment_command_64 *text_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, "__TEXT", &text_cmd)) {
  FATAL("Unable to find __TEXT command in GetSectionAndSlide\n")do { printf("[-] PROGRAM ABORT : " "Unable to find __TEXT command in GetSectionAndSlide\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 427); exit(1); } while (0);
}
*file_vm_slide = (size_t)mach_header_address - text_cmd->vmaddr;

segment_command_64 *seg_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, segname, &seg_cmd)) {
  return false;
}

bool found_section = false;
size_t section_addr = (size_t)seg_cmd + sizeof(segment_command_64);
for (uint32_t i = 0; i < seg_cmd->nsects && !found_section; ++i) {
  section_64 *section = (section_64*)section_addr;
  if (!strcmp(section->sectname, sectname)) {
    *ret_section = *section;
    found_section = true;
  }

  section_addr += sizeof(section_64);
}

free(load_commands_buffer);
return found_section;
450}

452void *Debugger::MakeSharedMemory(mach_vm_address_t address, size_t size, MemoryProtection protection) {
mach_port_t shm_port;
if (address == 0)
  return NULL__null;

memory_object_size_t memoryObjectSize = round_page(size)(((size) + (vm_page_size - 1)) & (~(vm_page_size - 1)));
vm_prot_t prot_flags = MacOSProtectionFlags(protection);
kern_return_t ret = mach_make_memory_entry_64(mach_target->Task(), &memoryObjectSize, address, prot_flags, &shm_port, MACH_PORT_NULL0);
if (ret != KERN_SUCCESS0) {
  FATAL("Error (%s) remote allocate share memory\n", mach_error_string(ret))do { printf("[-] PROGRAM ABORT : " "Error (%s) remote allocate share memory\n"
, mach_error_string(ret)); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 461); exit(1); } while (0);
}

mach_vm_address_t map_address = 0;
ret = mach_vm_map(mach_task_self()mach_task_self_, &map_address, memoryObjectSize, 0, VM_FLAGS_ANYWHERE0x00000001, shm_port, 0, 0, prot_flags, prot_flags, VM_INHERIT_NONE((vm_inherit_t) 2));
if (ret != KERN_SUCCESS0) {
  FATAL("Error (%s) map memory\n", mach_error_string(ret))do { printf("[-] PROGRAM ABORT : " "Error (%s) map memory\n",
 mach_error_string(ret)); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 467); exit(1); } while (0);
}

SharedMemory sm(map_address, address, size, shm_port);
shared_memory.push_back(sm);

return (void *)map_address;
474}

476void *Debugger::RemoteAllocateNear(uint64_t region_min,
		    uint64_t region_max,
		    size_t size,
		    MemoryProtection protection,
		    bool use_shared_memory) {
uint64_t min_address, max_address;

//try after first
min_address = region_max;
max_address = (UINT64_MAX18446744073709551615ULL - region_min < 0x80000000) ? UINT64_MAX18446744073709551615ULL : region_min + 0x80000000;
void *ret_address = RemoteAllocateAfter(min_address, max_address, size, protection);
if (ret_address != NULL__null) {
  if (use_shared_memory)
    MakeSharedMemory((mach_vm_address_t)ret_address, size, protection);
  return ret_address;
}

//try before second
min_address = (region_max < 0x80000000) ? 0 : region_max - 0x80000000;
max_address = (region_min < size) ? 0 : region_min - size;
ret_address = RemoteAllocateBefore(min_address, max_address, size, protection);
if (ret_address != NULL__null) {
  if (use_shared_memory)
    MakeSharedMemory((mach_vm_address_t)ret_address, size, protection);
  return ret_address;
}

// if all else fails, try within
ret_address = RemoteAllocateAfter(region_min, region_max, size, protection);
if (use_shared_memory)
  MakeSharedMemory((mach_vm_address_t)ret_address, size, protection);
return ret_address;
508}

510void *Debugger::RemoteAllocate(size_t size,
                             MemoryProtection protection,
                             bool use_shared_memory) {
mach_vm_address_t alloc_address = 0;
vm_prot_t protection_flags = MacOSProtectionFlags(protection);

kern_return_t krt = mach_vm_allocate(mach_target->Task(),
                                     (mach_vm_address_t*)&alloc_address,
                                     size,
                                     VM_FLAGS_ANYWHERE0x00000001);

if (krt != KERN_SUCCESS0) {
  FATAL("Unable to allocate memory, size 0x%lx\n", size)do { printf("[-] PROGRAM ABORT : " "Unable to allocate memory, size 0x%lx\n"
, size); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 522); exit(1); } while (0);
}
RemoteProtect((void *)alloc_address, size, protection_flags);

if (use_shared_memory) {
  MakeSharedMemory(alloc_address, size, protection);
}

return (void *)alloc_address;
531}

533void *Debugger::RemoteAllocateBefore(uint64_t min_address,
                                        uint64_t max_address,
                                        size_t size,
                                        MemoryProtection protection) {
vm_prot_t protection_flags = MacOSProtectionFlags(protection);

mach_vm_address_t cur_address = max_address;
while (cur_address > min_address) {
  size_t step = size;

  mach_vm_address_t region_address = cur_address;
  mach_vm_size_t region_size = 0;
  vm_region_submap_info_data_64_t info;
  mach_target->GetRegionSubmapInfo(&region_address, &region_size, &info);

  if (region_address <= cur_address) { /* cur_address references allocated memory */
    cur_address = region_address;
  } else { /* cur_address references unallocated memory */
    uint64_t free_region_size = region_address - cur_address;
    if (free_region_size >= size) {
      void *ret_address = (void*)(cur_address + (free_region_size - size));
      kern_return_t krt = RemoteAllocateAt(ret_address, size);

      if (krt == KERN_SUCCESS0) {
        if (!(min_address <= (uint64_t)ret_address && (uint64_t)ret_address <= max_address)) {
          return NULL__null;
        }

        RemoteProtect(ret_address, size, protection_flags);
        return ret_address;
      }
    } else {
      step = size - free_region_size;
    }
  }

  if (cur_address < step) break;
  cur_address -= step;
}

return NULL__null;
574}

576void *Debugger::RemoteAllocateAfter(uint64_t min_address,
                                       uint64_t max_address,
                                       size_t size,
                                       MemoryProtection protection) {
vm_prot_t protection_flags = MacOSProtectionFlags(protection);

mach_vm_address_t cur_address = min_address;
while (cur_address < max_address) {
  mach_vm_address_t region_address = cur_address;
  mach_vm_size_t region_size = 0;
  vm_region_submap_info_data_64_t info;
  mach_target->GetRegionSubmapInfo(&region_address, &region_size, &info);

  if (region_address <= cur_address) { /* cur_address references allocated memory */
    cur_address = region_address + region_size;
    continue;
  }

  /* cur_address references unallocated memory */
  if (region_address > max_address) {
    region_address = max_address;
  }

  uint64_t free_region_size = region_address - cur_address;
  if (free_region_size >= size) {
    void *ret_address = (void*)cur_address;
    kern_return_t krt = RemoteAllocateAt(ret_address, size);

    if (krt == KERN_SUCCESS0) {
      if (!(min_address <= (uint64_t)ret_address && (uint64_t)ret_address <= max_address)) {
        return NULL__null;
      }

      RemoteProtect(ret_address, size, protection_flags);
      return ret_address;
    }
  }

  cur_address = region_address;
}

return NULL__null;
618}

620void *Debugger::RemoteAllocate(size_t size) {
kern_return_t krt;
void *alloc_address = 0;
krt = mach_vm_allocate(mach_target->Task(),
                      (mach_vm_address_t*)&alloc_address,
                      size,
                      VM_FLAGS_ANYWHERE0x00000001);

if (krt != KERN_SUCCESS0) {
  return NULL__null;
}

return alloc_address;
633}

635kern_return_t Debugger::RemoteAllocateAt(void *ret_address, int size) {
kern_return_t krt;
bool retried = false;

639retry_label:
void *alloc_address = ret_address;
krt = mach_vm_allocate(mach_target->Task(),
                      (mach_vm_address_t*)&alloc_address,
                      size,
                      VM_FLAGS_FIXED0x00000000);

if (krt == KERN_NO_SPACE3 && !retried) {
  krt = mach_vm_deallocate(mach_target->Task(),
                           (mach_vm_address_t)ret_address,
                           size);
  if (krt != KERN_SUCCESS0) {
    FATAL("Unable to deallocate memory region starting @ %p, size 0x%x\n",do { printf("[-] PROGRAM ABORT : " "Unable to deallocate memory region starting @ %p, size 0x%x\n"
, ret_address, size); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 652); exit(1); } while (0)
          ret_address, size)do { printf("[-] PROGRAM ABORT : " "Unable to deallocate memory region starting @ %p, size 0x%x\n"
, ret_address, size); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 652); exit(1); } while (0);
  }

  retried = true;
  goto retry_label;
}

return krt;
660}

662void Debugger::DeleteBreakpoints() {
for (auto iter = breakpoints.begin(); iter != breakpoints.end(); iter++) {
  delete *iter;
}
breakpoints.clear();
667}


670void Debugger::AddBreakpoint(void *address, int type) {
for (auto it = breakpoints.rbegin(); it != breakpoints.rend(); ++it) {
  if ((*it)->address == address) {
    (*it)->type |= type;
    if (((*it)->type & BREAKPOINT_NOTIFICATION0x04) && ((*it)->type & BREAKPOINT_TARGET0x02)) {
      FATAL("Target method must not be the same as _dyld_debugger_notification")do { printf("[-] PROGRAM ABORT : " "Target method must not be the same as _dyld_debugger_notification"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 675); exit(1); } while (0);
    }

    return;
  }
}

Breakpoint *new_breakpoint = new Breakpoint;
683#ifdef ARM641
uint32_t breakpoint_bytes = 0xd4200020;
685#else
unsigned char breakpoint_bytes = 0xcc;
687#endif
RemoteRead(address, &(new_breakpoint->original_opcode), sizeof(new_breakpoint->original_opcode));
RemoteWrite(address, (void*)&breakpoint_bytes, sizeof(breakpoint_bytes));

new_breakpoint->address = address;
new_breakpoint->type = type;
breakpoints.push_back(new_breakpoint);
694}

696void Debugger::GetFunctionArguments(uint64_t *arguments, size_t num_arguments, uint64_t sp, CallingConvention callconv) {
for (int arg_index = 0; arg_index < MAX_NUM_REG_ARGS8 && arg_index < num_arguments; ++arg_index) {
  arguments[arg_index] = GetRegister(ArgumentToRegister(arg_index));
}

if (num_arguments > MAX_NUM_REG_ARGS8) {
  RemoteRead((void*)((uint64_t)sp + child_ptr_size),
             arguments + MAX_NUM_REG_ARGS8,
             child_ptr_size * (num_arguments - MAX_NUM_REG_ARGS8));
}
706}

708void Debugger::SetFunctionArguments(uint64_t *arguments, size_t num_arguments, uint64_t sp, CallingConvention callconv) {
for (int arg_index = 0; arg_index < MAX_NUM_REG_ARGS8 && arg_index < num_arguments; ++arg_index) {
  SetRegister(ArgumentToRegister(arg_index), arguments[arg_index]);
}

if (num_arguments > MAX_NUM_REG_ARGS8) {
  RemoteWrite((void*)((uint64_t)sp + child_ptr_size),
              arguments + MAX_NUM_REG_ARGS8,
              child_ptr_size * (num_arguments - MAX_NUM_REG_ARGS8));
}
718}

720void Debugger::HandleTargetReachedInternal() {
saved_sp = (void*)GetRegister(ARCH_SPSP);
saved_return_address = (void*)GetReturnAddress();

if (loop_mode) {
  GetFunctionArguments((uint64_t *)saved_args, target_num_args, (uint64_t)saved_sp, CALLCONV_DEFAULT);
}

if (!target_reached) {
  target_reached = true;
  OnTargetMethodReached();
}

if (target_end_detection == RETADDR_STACK_OVERWRITE) {
  size_t return_address = PERSIST_END_EXCEPTION0x0F22;
  RemoteWrite(saved_sp, &return_address, child_ptr_size);
} else if (target_end_detection == RETADDR_BREAKPOINT) {
  AddBreakpoint((void*)GetTranslatedAddress((size_t)saved_return_address), BREAKPOINT_TARGET_END0x08);
}
739}


742void Debugger::HandleTargetEnded() {
target_return_value = (uint64_t)GetRegister(ARCH_RETURN_VALUE_REGISTERX0);

if (loop_mode) {
  SetRegister(ARCH_PCPC, (size_t)target_address);
  SetRegister(ARCH_SPSP, (size_t)saved_sp);

  if (target_end_detection == RETADDR_STACK_OVERWRITE) {
    size_t return_address = PERSIST_END_EXCEPTION0x0F22;
    SetReturnAddress(return_address);
  } else if (target_end_detection == RETADDR_BREAKPOINT) {
    SetReturnAddress((size_t)saved_return_address);
    AddBreakpoint((void*)GetTranslatedAddress((size_t)saved_return_address), BREAKPOINT_TARGET_END0x08);
  }

  SetFunctionArguments((uint64_t *)saved_args, target_num_args, (uint64_t)saved_sp, CALLCONV_DEFAULT);
} else {
  SetRegister(ARCH_PCPC, (size_t)saved_return_address);
  AddBreakpoint((void*)GetTranslatedAddress((size_t)target_address), BREAKPOINT_TARGET0x02);
}
762}

764void Debugger::OnEntrypoint() {
child_entrypoint_reached = true;
if (trace_debug_events) {
  SAY("Debugger: Process entrypoint reached\n")printf("Debugger: Process entrypoint reached\n");
}
769}


772void Debugger::ExtractCodeRanges(void *base_address,
                               size_t min_address,
                               size_t max_address,
                               std::list<AddressRange> *executable_ranges,
                               size_t *code_size) {
mach_header_64 mach_header;
GetMachHeader(base_address, &mach_header);

void *load_commands_buffer = NULL__null;
GetLoadCommandsBuffer(base_address, &mach_header, &load_commands_buffer);

segment_command_64 *text_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, "__TEXT", &text_cmd)) {
  FATAL("Unable to find __TEXT command in ExtractCodeRanges\n")do { printf("[-] PROGRAM ABORT : " "Unable to find __TEXT command in ExtractCodeRanges\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 785); exit(1); } while (0);
}
uint64_t file_vm_slide = (uint64_t)base_address - text_cmd->vmaddr;

*code_size = 0;
for (auto &it: *executable_ranges) {
  free(it.data);
}
executable_ranges->clear();

uint64_t load_cmd_addr = (uint64_t)load_commands_buffer;
for (uint32_t i = 0; i < mach_header.ncmds; ++i) {
  load_command *load_cmd = (load_command *)load_cmd_addr;
  if (load_cmd->cmd == LC_SEGMENT_640x19) {
    segment_command_64 *segment_cmd = (segment_command_64*)load_cmd;

    if (!strcmp(segment_cmd->segname, "__PAGEZERO")
        || !strcmp(segment_cmd->segname, "__LINKEDIT")) {
      load_cmd_addr += load_cmd->cmdsize;
      continue;
    }

807#ifdef ARM641
    if (strcmp(segment_cmd->segname, "__TEXT") == 0) {
      mach_vm_address_t segment_start_addr = (mach_vm_address_t)segment_cmd->vmaddr + file_vm_slide;
      mach_vm_address_t segment_end_addr = (mach_vm_address_t)segment_cmd->vmaddr + file_vm_slide + segment_cmd->vmsize;
      AddressRange arm_ar;
      arm_ar.from = segment_start_addr;
      arm_ar.to = segment_end_addr;
      size_t range_size = arm_ar.to - arm_ar.from;
      arm_ar.data = (char *)malloc(range_size);
      RemoteRead((void*)arm_ar.from, arm_ar.data, range_size);

      ExtractSegmentCodeRanges(segment_start_addr, segment_end_addr, executable_ranges, code_size);
      for(const auto& er: *executable_ranges) { 
        free(er.data);
      }
      executable_ranges->clear();
      executable_ranges->push_back(arm_ar);
      *code_size = range_size;
      break;
    }
827#else
    mach_vm_address_t segment_start_addr = (mach_vm_address_t)segment_cmd->vmaddr + file_vm_slide;
    mach_vm_address_t segment_end_addr = (mach_vm_address_t)segment_cmd->vmaddr + file_vm_slide + segment_cmd->vmsize;

    ExtractSegmentCodeRanges(segment_start_addr, segment_end_addr, executable_ranges, code_size);
832#endif
  }

  load_cmd_addr += load_cmd->cmdsize;
}

free(load_commands_buffer);
839}

841void Debugger::ExtractSegmentCodeRanges(mach_vm_address_t segment_start_addr,
                                      mach_vm_address_t segment_end_addr,
                                      std::list<AddressRange> *executable_ranges,
                                      size_t *code_size) {
mach_vm_address_t cur_address = segment_start_addr;
while (cur_address < segment_end_addr) {
  mach_vm_size_t region_size = 0;
  vm_region_submap_info_data_64_t info;
  mach_target->GetRegionSubmapInfo(&cur_address, &region_size, &info);
  if (segment_end_addr <= cur_address) {
    break;
  }

  AddressRange new_range;
  new_range.from = cur_address;
  new_range.to = cur_address + region_size;
  if (new_range.from < segment_start_addr) {
    new_range.from = segment_start_addr;
  }
  if (segment_end_addr < new_range.to) {
    new_range.to = segment_end_addr;
  }

  if (info.protection & VM_PROT_EXECUTE((vm_prot_t) 0x04)) {
    int retried = false;

    size_t range_size = new_range.to - new_range.from;
    new_range.data = (char *)malloc(range_size);
    RemoteRead((void*)new_range.from, new_range.data, range_size);

  retry_label:
    RemoteProtect((void*)new_range.from, range_size, info.protection ^ VM_PROT_EXECUTE((vm_prot_t) 0x04));
    mach_vm_address_t region_addr = new_range.from;
    mach_vm_size_t region_sz = range_size;
    vm_region_submap_info_data_64_t region_info;
    mach_target->GetRegionSubmapInfo(&region_addr, (mach_vm_size_t*)&region_sz, &region_info);
    if (region_info.protection & VM_PROT_EXECUTE((vm_prot_t) 0x04)) {
      if (retried) {
        FATAL("Failed to mark the original code NON-EXECUTABLE\n")do { printf("[-] PROGRAM ABORT : " "Failed to mark the original code NON-EXECUTABLE\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 879); exit(1); } while (0);
      }

      kern_return_t krt;
      krt = mach_vm_deallocate(mach_target->Task(),
                               (mach_vm_address_t)new_range.from,
                               range_size);

      if (krt == KERN_SUCCESS0) {
        mach_vm_address_t alloc_address = new_range.from;
        krt = mach_vm_allocate(mach_target->Task(),
                               (mach_vm_address_t*)&alloc_address,
                               range_size,
                               VM_FLAGS_FIXED0x00000000);

        if (krt == KERN_SUCCESS0 && alloc_address && new_range.from) {
          RemoteWrite((void*)new_range.from, new_range.data, range_size);
        } else {
          FATAL("Unable to re-allocate memory after deallocate in ExtractSegmentCodeRanges\n")do { printf("[-] PROGRAM ABORT : " "Unable to re-allocate memory after deallocate in ExtractSegmentCodeRanges\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 897); exit(1); } while (0);
        }
      }

      retried = true;
      goto retry_label;
    }

    AddressRange *last_range = NULL__null;
    if(!executable_ranges->empty()) {
      last_range = &executable_ranges->back();
    }
    if(last_range && (last_range->to == new_range.from)) {
      // merge ranges instead of creating new one
      size_t last_range_size = last_range->to - last_range->from;
      size_t merged_size = last_range_size + range_size;
      last_range->data = (char *)realloc(last_range->data, merged_size);
      memcpy(last_range->data + last_range_size, new_range.data, range_size);
      last_range->to = new_range.to;
      free(new_range.data);
    } else {
      executable_ranges->push_back(new_range);
    }
    *code_size += range_size;
  }

  cur_address += region_size;
}
925}


928void Debugger::ProtectCodeRanges(std::list<AddressRange> *executable_ranges) {
WARN("persist_instrumentation_data functionality was not tested on macOS."do { printf("[!] WARNING: " "persist_instrumentation_data functionality was not tested on macOS."
 "ProtectCodeRanges might fail"); printf("\n"); } while (0)
     "ProtectCodeRanges might fail")do { printf("[!] WARNING: " "persist_instrumentation_data functionality was not tested on macOS."
 "ProtectCodeRanges might fail"); printf("\n"); } while (0);

for (auto &range: *executable_ranges) {
  mach_vm_address_t region_address = range.from;
  mach_vm_size_t region_size = 0;
  vm_region_submap_info_data_64_t info;
  mach_target->GetRegionSubmapInfo(&region_address, &region_size, &info);

  if (region_address != range.from
      || region_address + region_size != range.to
      || !(info.protection & VM_PROT_EXECUTE((vm_prot_t) 0x04))) {
    FATAL("Error in ProtectCodeRanges. Target incompatible with persist_instrumentation_data")do { printf("[-] PROGRAM ABORT : " "Error in ProtectCodeRanges. Target incompatible with persist_instrumentation_data"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 941); exit(1); } while (0);
  }

  RemoteProtect((void*)region_address, region_size, info.protection ^ VM_PROT_EXECUTE((vm_prot_t) 0x04));
}
946}

948void Debugger::PatchPointersRemote(void *base_address, std::unordered_map<size_t, size_t>& search_replace) {
mach_header_64 mach_header;
GetMachHeader(base_address, &mach_header);

void *load_commands_buffer = NULL__null;
GetLoadCommandsBuffer(base_address, &mach_header, &load_commands_buffer);

segment_command_64 *text_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, "__TEXT", &text_cmd)) {
  FATAL("Unable to find __TEXT command in ExtractCodeRanges\n")do { printf("[-] PROGRAM ABORT : " "Unable to find __TEXT command in ExtractCodeRanges\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 957); exit(1); } while (0);
}
uint64_t file_vm_slide = (uint64_t)base_address - text_cmd->vmaddr;

uint64_t load_cmd_addr = (uint64_t)load_commands_buffer;
for (uint32_t i = 0; i < mach_header.ncmds; ++i) {
  load_command *load_cmd = (load_command *)load_cmd_addr;
  if (load_cmd->cmd == LC_SEGMENT_640x19) {
    segment_command_64 *segment_cmd = (segment_command_64*)load_cmd;

    if (!strcmp(segment_cmd->segname, "__PAGEZERO")
        || !strcmp(segment_cmd->segname, "__LINKEDIT")) {
      load_cmd_addr += load_cmd->cmdsize;
      continue;
    }

    mach_vm_address_t segment_start_addr = (mach_vm_address_t)segment_cmd->vmaddr + file_vm_slide;
    mach_vm_address_t segment_end_addr = (mach_vm_address_t)segment_cmd->vmaddr + file_vm_slide + segment_cmd->vmsize;

    PatchPointersRemote(segment_start_addr, segment_end_addr, search_replace);
  }

  load_cmd_addr += load_cmd->cmdsize;
}

free(load_commands_buffer);
983}

985void Debugger::PatchPointersRemote(size_t min_address, size_t max_address, std::unordered_map<size_t, size_t>& search_replace) {
size_t module_size = max_address - min_address;
char* buf = (char *)malloc(module_size);
RemoteRead((void *)min_address, buf, module_size);

size_t remote_address = min_address;
for (size_t i = 0; i < (module_size - child_ptr_size + 1); i++) {
  size_t ptr = *(size_t *)(buf + i);
  auto iter = search_replace.find(ptr);
  if (iter != search_replace.end()) {
    // printf("patching entry %zx at address %zx\n", (size_t)ptr, remote_address);
    size_t fixed_ptr = (size_t)iter->second;
    RemoteWrite((void *)remote_address, &fixed_ptr, child_ptr_size);
  }
  remote_address += 1;
}

free(buf);
1003}


1006void Debugger::GetImageSize(void *base_address, size_t *min_address, size_t *max_address) {
mach_header_64 mach_header;
GetMachHeader(base_address, &mach_header);

void *load_commands_buffer = NULL__null;
GetLoadCommandsBuffer(base_address, &mach_header, &load_commands_buffer);

*min_address = SIZE_MAX18446744073709551615UL;
*max_address = 0;

uint64_t load_cmd_addr = (uint64_t)load_commands_buffer;
for (uint32_t i = 0; i < mach_header.ncmds; ++i) {
  load_command *load_cmd = (load_command *)load_cmd_addr;
  if (load_cmd->cmd == LC_SEGMENT_640x19) {
    segment_command_64 *segment_cmd = (segment_command_64*)load_cmd;

    if (!strcmp(segment_cmd->segname, "__PAGEZERO")
        || !strcmp(segment_cmd->segname, "__LINKEDIT")) {
      load_cmd_addr += load_cmd->cmdsize;
      continue;
    }

    if (segment_cmd->vmaddr < *min_address) {
      *min_address = segment_cmd->vmaddr;
    }

    if (segment_cmd->vmaddr + segment_cmd->vmsize > *max_address) {
      *max_address = segment_cmd->vmaddr + segment_cmd->vmsize;
    }
  }

  load_cmd_addr += load_cmd->cmdsize;
}

segment_command_64 *text_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, "__TEXT", &text_cmd)) {
  FATAL("Unable to find __TEXT command in GetImageSize\n")do { printf("[-] PROGRAM ABORT : " "Unable to find __TEXT command in GetImageSize\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1042); exit(1); } while (0);
}

uint64_t file_vm_slide = (uint64_t)base_address - text_cmd->vmaddr;
*min_address += file_vm_slide;
*max_address += file_vm_slide;

free(load_commands_buffer);
1050}


1053void *Debugger::GetModuleEntrypoint(void *base_address) {
mach_header_64 mach_header;
GetMachHeader(base_address, &mach_header);
if (mach_header.filetype != MH_EXECUTE0x2) {
  return NULL__null;
}

void *load_commands_buffer = NULL__null;
GetLoadCommandsBuffer(base_address, &mach_header, &load_commands_buffer);

entry_point_command *entry_point_cmd = NULL__null;
if (GetLoadCommand(mach_header, load_commands_buffer, LC_MAIN(0x28|0x80000000), NULL__null, &entry_point_cmd)) {
  uint64_t entryoff = entry_point_cmd->entryoff;

  free(load_commands_buffer);
  return (void*)((uint64_t)base_address + entryoff);
}

// no LC_MAIN command, probably an older binary.
// Look up LC_UNIXTHREAD instead

thread_command *tc;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_UNIXTHREAD0x5, NULL__null, &tc)) {
  FATAL("Unable to find entry point in the executable module")do { printf("[-] PROGRAM ABORT : " "Unable to find entry point in the executable module"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1076); exit(1); } while (0);
}

uint32_t flavor = *(uint32_t *)((char *)tc + 2 * sizeof(uint32_t));
if(flavor != ARCH_THREAD_STATE6) {
  FATAL("Unexpected thread state flavor")do { printf("[-] PROGRAM ABORT : " "Unexpected thread state flavor"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1081); exit(1); } while (0);
}
ARCH_THREAD_STATE_Tarm_thread_state64_t *state = (ARCH_THREAD_STATE_Tarm_thread_state64_t *)((char *)tc + 4 * sizeof(uint32_t));

segment_command_64 *text_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, "__TEXT", &text_cmd)) {
  FATAL("Unable to find __TEXT command in GetModuleEntrypoint\n")do { printf("[-] PROGRAM ABORT : " "Unable to find __TEXT command in GetModuleEntrypoint\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1087); exit(1); } while (0);
}
uint64_t file_vm_slide = (uint64_t)base_address - text_cmd->vmaddr;

free(load_commands_buffer);
1092#ifdef ARM641
return (void*)(state->__pc + file_vm_slide);
1094#else
return (void*)(state->__rip + file_vm_slide);
1096#endif
1097}

1099bool Debugger::IsDyld(void *base_address) {
mach_header_64 mach_header;
GetMachHeader(base_address, &mach_header);

return (mach_header.filetype == MH_DYLINKER0x7);
1104}


1107void *Debugger::GetSymbolAddress(void *base_address, const char *symbol_name) {
mach_header_64 mach_header;
GetMachHeader(base_address, &mach_header);
bool in_shared_cache = (mach_header.filetype == MH_DYLIB0x6)
                       && (mach_header.flags & MH_DYLIB_IN_CACHE0x80000000);

void *load_commands_buffer = NULL__null;
GetLoadCommandsBuffer(base_address, &mach_header, &load_commands_buffer);

symtab_command *symtab_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SYMTAB0x2, NULL__null, &symtab_cmd)) {
  FATAL("Unable to find SYMTAB command in GetSymbolAddress\n")do { printf("[-] PROGRAM ABORT : " "Unable to find SYMTAB command in GetSymbolAddress\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1118); exit(1); } while (0);
}

segment_command_64 *linkedit_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, "__LINKEDIT", &linkedit_cmd)) {
  FATAL("Unable to find __LINKEDIT command in GetSymbolAddress\n")do { printf("[-] PROGRAM ABORT : " "Unable to find __LINKEDIT command in GetSymbolAddress\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1123); exit(1); } while (0);
}

segment_command_64 *text_cmd = NULL__null;
if (!GetLoadCommand(mach_header, load_commands_buffer, LC_SEGMENT_640x19, "__TEXT", &text_cmd)) {
  FATAL("Unable to find __TEXT command in GetSymbolAddress\n")do { printf("[-] PROGRAM ABORT : " "Unable to find __TEXT command in GetSymbolAddress\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1128); exit(1); } while (0);
}

uint64_t file_vm_slide = (uint64_t)base_address - text_cmd->vmaddr;

char *strtab = NULL__null;
uint64_t strtab_addr = linkedit_cmd->vmaddr + file_vm_slide
                       + symtab_cmd->stroff - linkedit_cmd->fileoff;
if(!in_shared_cache) {
  strtab = (char*)malloc(symtab_cmd->strsize);
  RemoteRead((void*)strtab_addr, strtab, symtab_cmd->strsize);
}

char *symtab = (char*)malloc(symtab_cmd->nsyms * sizeof(nlist_64));
uint64_t symtab_addr = linkedit_cmd->vmaddr + file_vm_slide
                       + symtab_cmd->symoff - linkedit_cmd->fileoff;
RemoteRead((void*)symtab_addr, symtab, symtab_cmd->nsyms * sizeof(nlist_64));

void *symbol_address = NULL__null;

size_t curr_symbol_address = (size_t)symtab;
for (int i = 0; i < symtab_cmd->nsyms && !symbol_address; ++i) {
  nlist_64 curr_symbol = *(nlist_64*)curr_symbol_address;
  if ((curr_symbol.n_type & N_TYPE0x0e) == N_SECT0xe) {
    char *curr_sym_name = NULL__null;
    std::string curr_sym_name_string;
    if (!in_shared_cache) {
      curr_sym_name = strtab + curr_symbol.n_un.n_strx;
    } else {
      mach_target->ReadCString(strtab_addr + curr_symbol.n_un.n_strx, curr_sym_name_string);
      curr_sym_name = (char*)curr_sym_name_string.c_str();
    }

    // printf("%s\n", curr_sym_name);
    if (!strcmp(curr_sym_name, symbol_name)) {
      symbol_address = (void*)((uint64_t)base_address - text_cmd->vmaddr + curr_symbol.n_value);
      break;
    }
  }

  curr_symbol_address += sizeof(nlist_64);
}

free(strtab);
free(symtab);
free(load_commands_buffer);
return symbol_address;
1175}

1177void *Debugger::GetTargetAddress(void *base_address) {
if (!target_offset) {
  void *method_address = GetSymbolAddress(base_address, target_method);
  if (method_address == NULL__null) {
    FATAL("Unable to find address of target method\n")do { printf("[-] PROGRAM ABORT : " "Unable to find address of target method\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1181); exit(1); } while (0);
  }

  target_offset = (uint64_t)method_address - (uint64_t)base_address;
}

return (void*)((uint64_t)base_address + target_offset);
1188}

1190void Debugger::OnModuleLoaded(void *module, char *module_name) {
if (trace_debug_events) {
  SAY("Debugger: Loaded module %s at %p\n", module_name, module)printf("Debugger: Loaded module %s at %p\n", module_name, module
);
}

if (!attach_mode) {
  void *entrypoint = GetModuleEntrypoint(module);
  if (entrypoint) {
    AddBreakpoint(entrypoint, BREAKPOINT_ENTRYPOINT0x01);
  }
}

if (IsDyld(module)) {
  HandleDyld(module);
}

if (target_function_defined && !strcasecmp(module_name, target_module)) {
  target_address = GetTargetAddress(module);
  if (!target_address) {
    FATAL("Error determining target method address\n")do { printf("[-] PROGRAM ABORT : " "Error determining target method address\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1209); exit(1); } while (0);
  }

  AddBreakpoint(target_address, BREAKPOINT_TARGET0x02);
}
1214}

1216void Debugger::HandleDyld(void *module) {
dyld_address = module;

m_dyld_debugger_notification = GetSymbolAddress(module, (char*)"__dyld_debugger_notification");
AddBreakpoint(m_dyld_debugger_notification, BREAKPOINT_NOTIFICATION0x04);

1222#ifdef ARM641
// For arm we just mov pc, lr on BREAKPOINT_NOTIFICATION
1224#else
// This save us the recurring TRAP FLAG breakpoint on BREAKPOINT_NOTIFICATION.
unsigned char ret = 0xC3;
RemoteWrite((void*)((uint64_t)m_dyld_debugger_notification+1), (void*)&ret, 1);
1228#endif
1229}

1231void Debugger::OnDyldImageNotifier(size_t mode, unsigned long infoCount, uint64_t machHeaders[]) {
uint64_t *image_info_array = new uint64_t[infoCount];
size_t image_info_array_size = sizeof(uint64_t) * infoCount;
RemoteRead(machHeaders, (void*)image_info_array, image_info_array_size);

if (mode == 1) { /* dyld_image_removing */
  for (unsigned long i = 0; i < infoCount; ++i) {
    OnModuleUnloaded((void*)image_info_array[i]);
  }
} else {
  dyld_all_image_infos all_image_infos = mach_target->GetAllImageInfos();

  // on macOS, it's possible for dyld to be loaded in two places
  // best effort to detect this here
  if(all_image_infos.dyldImageLoadAddress != dyld_address) {
    HandleDyld((void *)all_image_infos.dyldImageLoadAddress);
  }

  dyld_image_info *all_image_info_array = new dyld_image_info[all_image_infos.infoArrayCount];
  size_t all_image_info_array_size = sizeof(dyld_image_info) * all_image_infos.infoArrayCount;
  if(all_image_info_array_size) {
    RemoteRead((void*)all_image_infos.infoArray, (void*)all_image_info_array, all_image_info_array_size);
  }

  char path[PATH_MAX1024];
  for (uint32_t i = 0; i < all_image_infos.infoArrayCount; ++i) {
    void *mach_header_addr = (void*)all_image_info_array[i].imageLoadAddress;
    if (mode == 2) { /* dyld_notify_remove_all */
      OnModuleUnloaded(mach_header_addr);
    } else if (std::find(image_info_array, image_info_array + infoCount, (uint64_t)mach_header_addr)
               != image_info_array + infoCount) {
      /* dyld_image_adding */
      mach_target->ReadCString((uint64_t)all_image_info_array[i].imageFilePath, PATH_MAX1024, path);
      char *base_name = strrchr((char*)path, '/');
      base_name = (base_name) ? base_name + 1 : (char*)path;
      OnModuleLoaded(mach_header_addr, base_name);
    }
  }

  delete [] all_image_info_array;
}

delete [] image_info_array;
1274}

1276void Debugger::OnProcessCreated() {
if (trace_debug_events) {
  SAY("Debugger: Process created or attached\n")printf("Debugger: Process created or attached\n");
}

kern_return_t krt;
dyld_process_info info = m_dyld_process_info_create(mach_target->Task(), 0, &krt);
if (krt != KERN_SUCCESS0) {
  FATAL("Unable to retrieve dyld_process_info_create information\n")do { printf("[-] PROGRAM ABORT : " "Unable to retrieve dyld_process_info_create information\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1284); exit(1); } while (0);
}

if (info) {
  m_dyld_process_info_for_each_image(
    info,
    ^(uint64_t mach_header_addr, const uuid_t uuid, const char *path) {
      if (attach_mode || IsDyld((void*)mach_header_addr)) {
        char *base_name = strrchr((char*)path, '/');
        base_name = (base_name) ? base_name + 1 : (char*)path;
        OnModuleLoaded((void*)mach_header_addr, (char*)base_name);
      }
    });

  m_dyld_process_info_release(info);
}
1300}


1303int Debugger::HandleDebuggerBreakpoint() {
int ret = BREAKPOINT_UNKNOWN0x0;

Breakpoint *breakpoint = NULL__null, *tmp_breakpoint;
for (auto iter = breakpoints.begin(); iter != breakpoints.end(); iter++) {
  tmp_breakpoint = *iter;
  if (tmp_breakpoint->address == (void*)((uint64_t)last_exception.ip)) {
    breakpoint = tmp_breakpoint;
    if (breakpoint->type & BREAKPOINT_NOTIFICATION0x04) {
      OnDyldImageNotifier(GetRegister(ArgumentToRegister(0)),
                          (unsigned long)GetRegister(ArgumentToRegister(1)),
                          (uint64_t*)GetRegister(ArgumentToRegister(2)));

      return BREAKPOINT_NOTIFICATION0x04;
    }

    breakpoints.erase(iter);
    break;
  }
}

if (!breakpoint) {
  return ret;
}

RemoteWrite(breakpoint->address, &breakpoint->original_opcode, sizeof(breakpoint->original_opcode));
1329#ifdef ARM641
SetRegister(ARCH_PCPC, GetRegister(ARCH_PCPC) - 4); // ARM
1331#else
SetRegister(ARCH_PCPC, GetRegister(ARCH_PCPC) - 1); // INTEL
1333#endif

if (breakpoint->type & BREAKPOINT_ENTRYPOINT0x01) {
    OnEntrypoint();
}

if (breakpoint->type & BREAKPOINT_TARGET0x02) {
    if (trace_debug_events) {
      SAY("Target method reached\n")printf("Target method reached\n");
    }
    HandleTargetReachedInternal();
}

if (breakpoint->type & BREAKPOINT_TARGET_END0x08) {
    if (trace_debug_events) {
      SAY("Target method ended\n")printf("Target method ended\n");
    }
    HandleTargetEnded();
}

ret = breakpoint->type;
free(breakpoint);

return ret;
1357}

1359bool Debugger::IsTargetAlive() {
return (mach_target != NULL__null && mach_target->IsTaskValid() && mach_target->IsExceptionPortValid());
1361}


1364void Debugger::HandleExceptionInternal(MachException *raised_mach_exception) {
mach_exception = raised_mach_exception;
CreateException(mach_exception, &last_exception);

dbg_continue_status = KERN_SUCCESS0;
handle_exception_status = DEBUGGER_CONTINUE;

if (mach_exception->exception_type == EXC_BREAKPOINT6) {
  int breakpoint_type = HandleDebuggerBreakpoint();
  if (breakpoint_type & BREAKPOINT_TARGET0x02) {
    handle_exception_status = DEBUGGER_TARGET_START;
  }
  if (breakpoint_type & BREAKPOINT_TARGET_END0x08) {
    handle_exception_status = DEBUGGER_TARGET_END;
  }
1379#ifdef ARM641
  if (breakpoint_type & BREAKPOINT_NOTIFICATION0x04) {
      SetRegister(ARCH_PCPC, GetRegister(LR));
      return;
  }
1384#endif

  if (breakpoint_type != BREAKPOINT_UNKNOWN0x0) {
    return;
  }
}

if (OnException(&last_exception)) {
  return;
}

if (trace_debug_events) {
  SAY("Debugger: Mach exception (%d) @ address %p\n",printf("Debugger: Mach exception (%d) @ address %p\n", mach_exception
->exception_type, last_exception.ip)
      mach_exception->exception_type, last_exception.ip)printf("Debugger: Mach exception (%d) @ address %p\n", mach_exception
->exception_type, last_exception.ip);
}

switch(mach_exception->exception_type) {
  case EXC_SYSCALL7:
    handle_exception_status = DEBUGGER_CONTINUE;
    dbg_continue_status = KERN_SUCCESS0;
    break;
  case EXC_RESOURCE11:
    handle_exception_status = DEBUGGER_HANGED;
    break;

  case EXC_BAD_ACCESS1:
  bad_access_label:
    if (target_function_defined && last_exception.ip == (void*)PERSIST_END_EXCEPTION0x0F22) {
      if (trace_debug_events) {
        SAY("Debugger: Persistence method ended\n")printf("Debugger: Persistence method ended\n");
      }

      HandleTargetEnded();
      handle_exception_status = DEBUGGER_TARGET_END;
    } else {
      dbg_continue_status = KERN_FAILURE5;
      handle_exception_status = DEBUGGER_CRASHED;
    }
    break;

  case EXC_BAD_INSTRUCTION2:
  case EXC_ARITHMETIC3:
  case EXC_CRASH10:
  case EXC_GUARD12:
  crash_label:
    dbg_continue_status = KERN_FAILURE5;
    handle_exception_status = DEBUGGER_CRASHED;
    break;

  case EXC_BREAKPOINT6:
    dbg_continue_status = KERN_FAILURE5;
    break;

  //Unix signals
  case EXC_SOFTWARE5:
    if (mach_exception->code_cnt < 2 || mach_exception->code[0] != EXC_SOFT_SIGNAL0x10003) {
      goto default_label;
    }

    switch (mach_exception->code[1]) {
      case SIGSEGV11:
      case SIGBUS10:
        goto bad_access_label;

      case SIGILL4:
      case SIGFPE8:
      case SIGABRT6:
      case SIGSYS12:
      case SIGPIPE13:
        goto crash_label;

      /* Handling the Unix soft signal produced by attaching via ptrace
        PT_ATTACHEXC suspends the process by using a SIGSTOP signal */
      case SIGSTOP17:
        OnProcessCreated();

        mach_exception->code[1] = 0;
        ptrace(PT_THUPDATE13,
               mach_target->Pid(),
              (caddr_t)(uintptr_t)mach_exception->thread_port,
              (int)mach_exception->code[1]);

        break;

      case SIGCHLD20:
        if (!IsTargetAlive()) {
          handle_exception_status = DEBUGGER_PROCESS_EXIT;
        }
        break;

      default:
        goto default_label;
    }

    break;

  default:
  default_label:
    if (trace_debug_events) {
      WARN("Debugger: Unhandled exception, mach exception_type %x at address %p\n",do { printf("[!] WARNING: " "Debugger: Unhandled exception, mach exception_type %x at address %p\n"
, mach_exception->exception_type, last_exception.ip); printf
("\n"); } while (0)
           mach_exception->exception_type, last_exception.ip)do { printf("[!] WARNING: " "Debugger: Unhandled exception, mach exception_type %x at address %p\n"
, mach_exception->exception_type, last_exception.ip); printf
("\n"); } while (0);
    }
    dbg_continue_status = KERN_FAILURE5;
}
1488}

1490void Debugger::SaveRegisters(SavedRegisters *registers) {
if((*(mach_exception->new_state_cnt)) * sizeof(mach_exception->new_state[0]) > sizeof(ARCH_THREAD_STATE_Tarm_thread_state64_t)) {
  FATAL("Unexpected thread state size")do { printf("[-] PROGRAM ABORT : " "Unexpected thread state size"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1492); exit(1); } while (0);
}

registers->gpr_count = *(mach_exception->new_state_cnt);

memcpy(&registers->gpr_registers,
       mach_exception->new_state,
       registers->gpr_count * sizeof(natural_t));

registers->fpu_count = sizeof(ARCH_FPU_STATE_Tarm_neon_state64_t) / sizeof(natural_t);
kern_return_t ret = thread_get_state(mach_exception->thread_port,
                                     ARCH_FPU_STATE17,
                                     (thread_state_t)&registers->fpu_registers,
                                     &registers->fpu_count);

if(ret != KERN_SUCCESS0) {
  FATAL("Error getting FPU registers %d", ret)do { printf("[-] PROGRAM ABORT : " "Error getting FPU registers %d"
, ret); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1508); exit(1); } while (0);
}
1510}

1512void Debugger::RestoreRegisters(SavedRegisters *registers) {
if(*mach_exception->new_state_cnt != registers->gpr_count) {
  FATAL("Unexpected thread state size")do { printf("[-] PROGRAM ABORT : " "Unexpected thread state size"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1514); exit(1); } while (0);
}

memcpy(mach_exception->new_state,
       &registers->gpr_registers,
       registers->gpr_count * sizeof(natural_t));

kern_return_t ret = thread_set_state(mach_exception->thread_port,
                                     ARCH_FPU_STATE17,
                                     (thread_state_t)&registers->fpu_registers,
                                     registers->fpu_count);

if(ret != KERN_SUCCESS0) {
  FATAL("Error setting FPU registers")do { printf("[-] PROGRAM ABORT : " "Error setting FPU registers"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1527); exit(1); } while (0);
}

1530}

1532void Debugger::PrintContext() {
thread_act_t *threads = NULL__null;
mach_msg_type_number_t num_threads = 0;
kern_return_t ret = task_threads(mach_target->Task(), &threads, &num_threads);
if(ret != KERN_SUCCESS0) return;
for(unsigned i=0;i<num_threads;i++) {
  ARCH_THREAD_STATE_Tarm_thread_state64_t state;
  unsigned int count = ARCH_THREAD_STATE_COUNT((mach_msg_type_number_t) (sizeof (arm_thread_state64_t)/sizeof
(uint32_t)));
  ret = thread_get_state(threads[i], ARCH_THREAD_STATE6, (thread_state_t)&state, &count);
  if(ret != KERN_SUCCESS0) continue;
1542#ifdef ARM641
  printf("thread %d\n", i);
  printf("pc: %llx\n", state.__pc);
  printf(" x0: %16llx  x1: %16llx  x2: %16llx  x3: %16llx\n", state.__x[0], state.__x[1], state.__x[2], state.__x[3]);
  printf(" x4: %16llx  x5: %16llx  x6: %16llx  x7: %16llx\n", state.__x[4], state.__x[5], state.__x[6], state.__x[7]);
  printf(" x8: %16llx  x9: %16llx x10: %16llx x11: %16llx\n", state.__x[8], state.__x[9], state.__x[10], state.__x[11]);
  printf("x12: %16llx x13: %16llx x14: %16llx x15: %16llx\n", state.__x[12], state.__x[13], state.__x[14], state.__x[15]);
  printf("x16: %16llx x17: %16llx x18: %16llx x19: %16llx\n", state.__x[16], state.__x[17], state.__x[18], state.__x[19]);
  printf("x20: %16llx x21: %16llx x22: %16llx x23: %16llx\n", state.__x[20], state.__x[21], state.__x[22], state.__x[23]);
  printf("x24: %16llx x25: %16llx x26: %16llx x27: %16llx\n", state.__x[24], state.__x[25], state.__x[26], state.__x[27]);
  printf("x28: %16llx\n", state.__x[28]);
  printf(" sp: %16llx  fp: %16llx  lr: %16llx cpsr: %8x\n\n", state.__sp, state.__fp, state.__lr, state.__cpsr);
  printf("stack:\n");
  uint64_t stack[100];
  mach_target->ReadMemory(state.__sp, sizeof(stack), stack);
1557#else
  printf("thread %d\n", i);
  printf("rip:%llx\n", state.__rip);
  printf("rax:%llx rbx:%llx rcx:%llx rdx:%llx\n", state.__rax, state.__rbx, state.__rcx, state.__rdx);
  printf("rsi:%llx rdi:%llx rbp:%llx rsp:%llx\n", state.__rsi, state.__rdi, state.__rbp, state.__rsp);
  printf("r8:%llx r9:%llx r10:%llx r11:%llx\n", state.__r8, state.__r9, state.__r10, state.__r11);
  printf("r12:%llx r13:%llx r14:%llx r15:%llx\n", state.__r12, state.__r13, state.__r14, state.__r15);
  printf("stack:\n");
  uint64_t stack[100];
  mach_target->ReadMemory(state.__rsp, sizeof(stack), stack);
1567#endif
  for(size_t j=0; j<(sizeof(stack)/sizeof(stack[0])); j++) {
    printf("%16llx\n", stack[j]);
  }
}
for(unsigned i=0;i<num_threads;i++) {
  mach_port_deallocate(mach_task_self()mach_task_self_, threads[i]);
}
vm_deallocate(mach_task_self()mach_task_self_, (vm_address_t)threads, num_threads * sizeof(thread_act_t));
1576}

1578DebuggerStatus Debugger::DebugLoop(uint32_t timeout) {
if (!IsTargetAlive()) {
  OnProcessExit();
  return DEBUGGER_PROCESS_EXIT;
}

if (dbg_continue_needed) {
  task_resume(mach_target->Task());
}

if (dbg_reply_needed) {
  mach_target->ReplyToException(reply_buffer);
}

bool alive = true;
while (alive) {
  dbg_continue_needed = false;
  dbg_reply_needed = false;

  if(target_memory_limit && alive && !killing_target) {
    vm_size_t mem_size = mach_target->MemSize();
    if(mem_size > target_memory_limit) {
      WARN("Target exceeded memory limit")do { printf("[!] WARNING: " "Target exceeded memory limit"); printf
("\n"); } while (0);
      task_suspend(mach_target->Task());
      dbg_continue_needed = true;
      return DEBUGGER_HANGED;
    }
  }

  uint64_t begin_time = GetCurTime();
  kern_return_t krt = mach_target->WaitForException(std::min(timeout, (uint32_t)100),
                                                    request_buffer,
                                                    sizeof(union __RequestUnion__catch_mach_exc_subsystem));
  uint64_t end_time = GetCurTime();

  uint64_t time_elapsed = end_time - begin_time;
  timeout = ((uint64_t)timeout >= time_elapsed) ? timeout - (uint32_t)time_elapsed : 0;

  switch (krt) {
    case MACH_RCV_TIMED_OUT0x10004003:
      if (timeout == 0) {
        task_suspend(mach_target->Task());
        dbg_continue_needed = true;
        return DEBUGGER_HANGED;
      }
      //go down into the MACH_RCV_INTERRUPTED case otherwise

    case MACH_RCV_INTERRUPTED0x10004005:
      if (!IsTargetAlive()) {
        alive = false;
      }

      continue;

    default:
      if (krt != MACH_MSG_SUCCESS0x00000000) {
        FATAL("Error (%s) returned by mach_msg (%x)\n", mach_error_string(krt), krt)do { printf("[-] PROGRAM ABORT : " "Error (%s) returned by mach_msg (%x)\n"
, mach_error_string(krt), krt); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1634); exit(1); } while (0);
      }
  }

  task_suspend(mach_target->Task());
  dbg_continue_needed = true;


  /* mach_exc_server calls catch_mach_exception_raise
     HandleExceptionInternal returns in ret_HandleExceptionInternal */
  boolean_t message_parsed_correctly = mach_exc_server(request_buffer, reply_buffer);
  if (!message_parsed_correctly) {
    krt = ((mig_reply_error_t *)reply_buffer)->RetCode;
    FATAL("Error (%s) returned in reply buffer by mach_exc_server\n", mach_error_string(krt))do { printf("[-] PROGRAM ABORT : " "Error (%s) returned in reply buffer by mach_exc_server\n"
, mach_error_string(krt)); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1647); exit(1); } while (0);
  }

  dbg_reply_needed = true;

  if (handle_exception_status == DEBUGGER_CRASHED) {
    OnCrashed(&last_exception);
  }

  if (handle_exception_status == DEBUGGER_PROCESS_EXIT) {
    alive = false;
    continue;
  }

  if (handle_exception_status != DEBUGGER_CONTINUE) {
    return handle_exception_status;
  }

  task_resume(mach_target->Task());
  mach_target->ReplyToException(reply_buffer);
}

OnProcessExit();
return DEBUGGER_PROCESS_EXIT;
1671}

1673/**
* Method not used, implementation is needed by the mach_exc_server method.
1675*/
1676kern_return_t catch_mach_exception_raise(
  mach_port_t exception_port,
  mach_port_t thread_port,
  mach_port_t task_port,
  exception_type_t exception_type,
  mach_exception_data_t code,
  mach_msg_type_number_t code_cnt) {
return MACH_RCV_INVALID_TYPE0x1000400d;
1684}


1687/**
* Method not used, implementation is needed by the mach_exc_server method.
*/
1690kern_return_t catch_mach_exception_raise_state(
  mach_port_t exception_port,
  exception_type_t exception_type,
  const mach_exception_data_t code,
  mach_msg_type_number_t code_cnt,
  int *flavor,
  const thread_state_t old_state,
  mach_msg_type_number_t old_state_cnt,
  thread_state_t new_state,
  mach_msg_type_number_t *new_state_cnt) {
return MACH_RCV_INVALID_TYPE0x1000400d;
1701}

1703/**
* Called by mach_exc_server
*
* @param exception_port the exception_port registered in AttachToProcess() method
* @param task_port the target_task
1708*/
1709kern_return_t catch_mach_exception_raise_state_identity(
  mach_port_t exception_port,
  mach_port_t thread_port,
  mach_port_t task_port,
  exception_type_t exception_type,
  mach_exception_data_t code,
  mach_msg_type_number_t code_cnt,
  int *flavor,
  thread_state_t old_state,
  mach_msg_type_number_t old_state_cnt,
  thread_state_t new_state,
  mach_msg_type_number_t *new_state_cnt) {

memcpy(new_state, old_state, old_state_cnt * sizeof(old_state[0]));
*new_state_cnt = old_state_cnt;

Debugger::MachException *mach_exception = new Debugger::MachException(exception_port,
                                                                      thread_port,
                                                                      task_port,
                                                                      exception_type,
                                                                      code,
                                                                      code_cnt,
                                                                      flavor,
                                                                      new_state,
                                                                      new_state_cnt);


class Debugger *dbg = NULL__null;
Debugger::map_mutex.lock();
auto it = Debugger::task_to_debugger_map.find(task_port);
if (it == Debugger::task_to_debugger_map.end() || it->second == NULL__null) {
1
Assuming field 'second' is not equal to NULL→
2
←
Taking false branch→
  FATAL("Debugger object could not be found in the map, task port = (%d)\n", task_port)do { printf("[-] PROGRAM ABORT : " "Debugger object could not be found in the map, task port = (%d)\n"
, task_port); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1740); exit(1); } while (0);
}
dbg = it->second;
Debugger::map_mutex.unlock();

if (!dbg->killing_target) {
3
←
Assuming field 'killing_target' is true→
4
←
Taking false branch→
  dbg->HandleExceptionInternal(mach_exception);
} else {
  dbg->dbg_continue_status = KERN_FAILURE5;
5
←
The value 5 is assigned to field 'dbg_continue_status'→
  dbg->handle_exception_status = DEBUGGER_CONTINUE;
}

kern_return_t krt;
krt = mach_port_deallocate(mach_task_self()mach_task_self_, task_port);
6
←
Value passed through parameter 'task_port' is deallocated→
if (krt != KERN_SUCCESS0) {
7
←
Assuming 'krt' is equal to KERN_SUCCESS→
8
←
Taking false branch→
  FATAL("Error (%s) deallocating the task port\n", mach_error_string(krt))do { printf("[-] PROGRAM ABORT : " "Error (%s) deallocating the task port\n"
, mach_error_string(krt)); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1755); exit(1); } while (0);
}

krt = mach_port_deallocate(mach_task_self()mach_task_self_, thread_port);
9
←
Value passed through parameter 'thread_port' is deallocated→
if (krt != KERN_SUCCESS0) {
10
←
Assuming 'krt' is equal to KERN_SUCCESS→
11
←
Taking false branch→
  FATAL("Error (%s) deallocating the thread port\n", mach_error_string(krt))do { printf("[-] PROGRAM ABORT : " "Error (%s) deallocating the thread port\n"
, mach_error_string(krt)); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1760); exit(1); } while (0);
}

delete mach_exception;
mach_exception = NULL__null;
return dbg->dbg_continue_status;
12
←
MIG callback fails with error after deallocating argument value. This is a use-after-free vulnerability because the caller will try to deallocate it again
1766}

1768void Debugger::OnProcessExit() {
if (trace_debug_events) {
  SAY("Debugger: Process exit\n")printf("Debugger: Process exit\n");
}

if (mach_target != NULL__null) {
  map_mutex.lock();
  int removed = task_to_debugger_map.erase(mach_target->Task());
  if (removed == 0) {
    WARN("There is no task port (%u) in task_to_debugger_map to be erased", mach_target->Task())do { printf("[!] WARNING: " "There is no task port (%u) in task_to_debugger_map to be erased"
, mach_target->Task()); printf("\n"); } while (0);
  }
  map_mutex.unlock();

  mach_target->CleanUp();
  delete mach_target;
  mach_target = NULL__null;

  ClearSharedMemory();
}

dyld_address = 0;

// collect any zombie processes at this point
int status;
while(wait3(&status, WNOHANG0x00000001, 0) > 0);
1793}


1796DebuggerStatus Debugger::Kill() {
if (mach_target == NULL__null) {
  return DEBUGGER_PROCESS_EXIT;
}

killing_target = true;
int target_pid = mach_target->Pid();
kill(target_pid, SIGKILL9);

//SIGKILL is not handled, so DebugLoop must return DEBUGGER_PROCESS_EXIT
dbg_last_status = DebugLoop(0xffffffff);
if (dbg_last_status != DEBUGGER_PROCESS_EXIT || IsTargetAlive()) {
  FATAL("Unable to kill the process\n")do { printf("[-] PROGRAM ABORT : " "Unable to kill the process\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1808); exit(1); } while (0);
}

DeleteBreakpoints();
killing_target = false;

return dbg_last_status;
1815}

1817char **Debugger::GetEnvp() {
int environ_size = 0;
char **p = environ;
while (*p) {
  environ_size += 1;
  p++;
}

int envp_size = environ_size + additional_env.size();
char **envp = (char**)malloc(sizeof(char*)*(envp_size+1));
int i;
for (i = 0; i < environ_size; ++i) {
  envp[i] = (char*)malloc(strlen(environ[i])+1);
  strcpy(envp[i], environ[i]);
}

for(auto iter = additional_env.begin(); iter != additional_env.end(); iter++) {
  envp[i] = (char*)malloc(iter->size() + 1);
  strcpy(envp[i], iter->c_str());
  i++;
}

envp[envp_size] = NULL__null;

return envp;
1842}


1845void Debugger::StartProcess(int argc, char **argv) {
if (argc <= 0) {
  FATAL("Number of arguments is not strictly positive")do { printf("[-] PROGRAM ABORT : " "Number of arguments is not strictly positive"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1847); exit(1); } while (0);
}

posix_spawn_file_actions_t *action_ptr = NULL__null;
posix_spawn_file_actions_t action;

if(mute_child) {
  action_ptr = &action;
  posix_spawn_file_actions_init(&action);
  posix_spawn_file_actions_addopen (&action, STDOUT_FILENO1, "/dev/null", O_WRONLY0x0001|O_APPEND0x00000008, 0);
  posix_spawn_file_actions_addopen (&action, STDERR_FILENO2, "/dev/null", O_WRONLY0x0001|O_APPEND0x00000008, 0);
}

pid_t pid;
int status;
posix_spawnattr_t attr;

status = posix_spawnattr_init(&attr);
if (status != 0) {
  FATAL("Unable to init spawnattr")do { printf("[-] PROGRAM ABORT : " "Unable to init spawnattr"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1866); exit(1); } while (0);
}

short posix_flags = POSIX_SPAWN_START_SUSPENDED0x0080;
if(disable_aslr) {
  posix_flags |= _POSIX_SPAWN_DISABLE_ASLR0x0100;
}
status = posix_spawnattr_setflags(&attr, posix_flags);
if (status != 0) {
  FATAL("Unable to set flags in posix_spawnattr_setflags")do { printf("[-] PROGRAM ABORT : " "Unable to set flags in posix_spawnattr_setflags"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1875); exit(1); } while (0);
}

char **envp = GetEnvp();
status = posix_spawn(&pid, argv[0], action_ptr, &attr, argv, envp);
if (status != 0) {
  FATAL("Error (%s) spawning the process\n", strerror(status))do { printf("[-] PROGRAM ABORT : " "Error (%s) spawning the process\n"
, strerror(status)); printf("         Location : %s(), %s:%u\n\n"
, __FUNCTION__, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1881); exit(1); } while (0);
}

for (char **p = envp; *p; p++) {
  free(*p);
}
free(envp);

mach_target = new MachTarget(pid);
1890}


1893void Debugger::AttachToProcess() {
killing_target = false;
dbg_continue_needed = false;
dbg_reply_needed = false;
target_reached = false;

DeleteBreakpoints();

int ptrace_ret;
ptrace_ret = ptrace(PT_ATTACHEXC14, mach_target->Pid(), 0, 0);
if (ptrace_ret == -1) {
  FATAL("Unable to ptrace PT_ATTACHEXC to the target process\n")do { printf("[-] PROGRAM ABORT : " "Unable to ptrace PT_ATTACHEXC to the target process\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1904); exit(1); } while (0);
}

map_mutex.lock();
task_to_debugger_map[mach_target->Task()] = this;
map_mutex.unlock();

dbg_last_status = DEBUGGER_ATTACHED;
1912}


1915DebuggerStatus Debugger::Attach(unsigned int pid, uint32_t timeout) {
attach_mode = true;
mach_target = new MachTarget(pid);
child_entrypoint_reached = true;

AttachToProcess();
return Continue(timeout);
1922}


1925DebuggerStatus Debugger::Run(char *cmd, uint32_t timeout) {
FATAL("Deprecated Run interface on macOS - use Run(int argc, char **argv, uint32_t timeout) instead")do { printf("[-] PROGRAM ABORT : " "Deprecated Run interface on macOS - use Run(int argc, char **argv, uint32_t timeout) instead"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 1926); exit(1); } while (0);
1927}


1930DebuggerStatus Debugger::Run(int argc, char **argv, uint32_t timeout) {
attach_mode = false;
child_entrypoint_reached = false;

StartProcess(argc, argv);
AttachToProcess();
return Continue(timeout);
1937}

1939DebuggerStatus Debugger::Continue(uint32_t timeout) {
if (loop_mode && (dbg_last_status == DEBUGGER_TARGET_END)) {
  dbg_last_status = DEBUGGER_TARGET_START;
  return dbg_last_status;
}

dbg_last_status = DebugLoop(timeout);
return dbg_last_status;
1947}


1950void Debugger::Init(int argc, char **argv) {
mach_target = NULL__null;
killing_target = false;

attach_mode = false;
trace_debug_events = false;
loop_mode = false;
disable_aslr = false;
target_function_defined = false;

target_return_value = 0;

target_module[0] = 0;
target_method[0] = 0;
target_offset = 0;
saved_args = NULL__null;
target_num_args = 0;
target_address = NULL__null;

1969#ifdef ARM641
target_end_detection = RETADDR_BREAKPOINT;
private_dlyd_cache = true;
1972#else
target_end_detection = RETADDR_STACK_OVERWRITE;
private_dlyd_cache = false;
1975#endif

dbg_last_status = DEBUGGER_NONE;
shared_memory.clear();

dbg_continue_needed = false;
dbg_reply_needed = false;
request_buffer = (mach_msg_header_t *)malloc(sizeof(union __RequestUnion__catch_mach_exc_subsystem));
reply_buffer = (mach_msg_header_t *)malloc(sizeof(union __ReplyUnion__catch_mach_exc_subsystem));

std::list<char *> env_options;
GetOptionAll("-target_env", argc, argv, &env_options);
for (auto iter = env_options.begin(); iter != env_options.end(); iter++) {
  additional_env.push_back(*iter);
}

char *option;
trace_debug_events = GetBinaryOption("-trace_debug_events",
                                     argc, argv,
                                     trace_debug_events);

option = GetOption("-target_module", argc, argv);
if (option) strncpy(target_module, option, PATH_MAX1024);

option = GetOption("-target_method", argc, argv);
if (option) strncpy(target_method, option, PATH_MAX1024);

loop_mode = GetBinaryOption("-loop", argc, argv, loop_mode);
disable_aslr = GetBinaryOption("-disable_aslr", argc, argv, disable_aslr);

option = GetOption("-nargs", argc, argv);
if (option) target_num_args = atoi(option);

option = GetOption("-target_offset", argc, argv);
if (option) target_offset = strtoul(option, NULL__null, 0);

// check if we are running in persistence mode
if (target_module[0] || target_offset || target_method[0]) {
  target_function_defined = true;
  if ((target_module[0] == 0) || ((target_offset == 0) && (target_method[0] == 0))) {
    FATAL("target_module and either target_offset or target_method must be specified together\n")do { printf("[-] PROGRAM ABORT : " "target_module and either target_offset or target_method must be specified together\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 2015); exit(1); } while (0);
  }
}

if (loop_mode && !target_function_defined) {
  FATAL("Target function needs to be defined to use the loop mode\n")do { printf("[-] PROGRAM ABORT : " "Target function needs to be defined to use the loop mode\n"
); printf("         Location : %s(), %s:%u\n\n", __FUNCTION__
, "/Users/xss/tmp/Jackalope-main/TinyInst/macOS/debugger.cpp"
, 2020); exit(1); } while (0);
}

// avoid overwriting return address in case we have libgmalloc in env
for (auto iter = additional_env.begin(); iter != additional_env.end(); iter++) {
  if (iter->find("libgmalloc") != std::string::npos) {
    target_end_detection = RETADDR_BREAKPOINT;
  }
}
private_dlyd_cache = GetBinaryOption("-private_dlyd_cache", argc, argv, private_dlyd_cache);
if (private_dlyd_cache) {
  additional_env.push_back("DYLD_SHARED_REGION=private");
}

if (target_num_args) {
  saved_args = (void **)malloc(target_num_args * sizeof(void *));
}

m_dyld_process_info_create =
    (void *(*)(task_t task, uint64_t timestamp, kern_return_t * kernelError))
        dlsym(RTLD_DEFAULT((void *) -2), "_dyld_process_info_create");
m_dyld_process_info_for_each_image =
    (void (*)(void *info, void (^)(uint64_t machHeaderAddress,
                                   const uuid_t uuid, const char *path)))
        dlsym(RTLD_DEFAULT((void *) -2), "_dyld_process_info_for_each_image");
m_dyld_process_info_release =
    (void (*)(void *info))dlsym(RTLD_DEFAULT((void *) -2), "_dyld_process_info_release");

target_memory_limit = 0;
option = GetOption("-mem_limit", argc, argv);
if (option) target_memory_limit = (uint64_t)strtoul(option, NULL__null, 0) * 1024 * 1024;

mute_child = GetBinaryOption("-mute_child", argc, argv, false);

dyld_address = NULL__null;
2055}