Stikked

Untitled

From Subtle Pheasant, 5 Years ago, written in Plain Text.
URL https://p.rhcp011235.rocks/view/35dde789
Embed
Download Paste or View Raw
  1. int _betterWorkingAndShit(int arg0, int arg1, int arg2, int arg3) {
  2.     r7 = (sp - 0x14) + 0xc;
  3.     sp = sp - 0xb8;
  4.     r11 = arg0;
  5.     r10 = arg3;
  6.     _logToFile("Hacking the kernel\n", arg1, arg2, arg3);
  7.     _kernelSize(arg1, sp + 0x8c);
  8.     _logToFile("Kernel size: 0x%08x\n", r10, arg2, arg3);
  9.     r5 = [[NSNotificationCenter defaultCenter] retain];
  10.     r7 = r7;
  11.     r4 = [[NSDictionary dictionaryWithObjects:sp + 0x88 forKeys:sp + 0x84 count:0x1, stack[2003], stack[2004], stack[2005], stack[2006], @selector(defaultCenter), @selector(dictionaryWithObjects:forKeys:count:), stack[2009], stack[2010], stack[2011], stack[2012], stack[2013], stack[2014], stack[2015], stack[2016], stack[2017], stack[2018], stack[2019], stack[2020], stack[2021], stack[2022], stack[2023], stack[2024], stack[2025], stack[2026], stack[2027]] retain];
  12.     [r5 postNotificationName:@"YLUDidReceiveUpdateProgressNotification" object:0x0 userInfo:r4];
  13.     [r4 release];
  14.     [r5 release];
  15.     r3 = sp + 0x7c;
  16.     r2 = r10;
  17.     stack[2010] = arg1;
  18.     stack[2009] = arg2;
  19.     _find_lwvm_patch_offsets(arg1, arg2, r2, r3, sp + 0x80);
  20.     asm { ldrd       r1, r2, [sp, #0xb0 + var_34] };
  21.     r0 = _logToFile("Will write 0x%08x,0x%08x\n", r1, r2, r3);
  22.     asm { ldrd       r3, r0, [sp, #0xb0 + var_34] };
  23.     stack[2004] = r11;
  24.     if (r3 <= 0x4) {
  25.             r2 = "\xC0F\xC0F";
  26.             r1 = vm_write(r11, r0 - r3, r2, r3);
  27.             if (r1 != 0x0) {
  28.                     r2 = "\xC0F\xC0F";
  29.                     _logToFile("Shit, vm write returned nonzero value: %d\n", r1, r2, r3);
  30.             }
  31.     }
  32.     else {
  33.             vm_write(*0x55dd0, r3, sp + 0x34, 0x4);
  34.     }
  35.     stack[2008] = @selector(dictionaryWithObjects:forKeys:count:);
  36.     stack[2006] = @selector(postNotificationName:object:userInfo:);
  37.     r7 = r7;
  38.     r5 = [[NSNotificationCenter defaultCenter] retain];
  39.     asm { strd       r1, r0, [sp, #0xb0 + var_3C] };
  40.     r7 = r7;
  41.     r4 = [objc_msgSend(@class(NSDictionary), stack[2008]) retain];
  42.     r6 = 0x0;
  43.     objc_msgSend(r5, stack[2006]);
  44.     [r4 release];
  45.     r0 = [r5 release];
  46.     asm { ldrd       fp, r0, [sp, #0xb0 + var_94] };
  47.     _find_remount_patch_offset(r0, r11, r10, sp + 0x70);
  48.     _logToFile("Found remount off: 0x%08x\n", stack[2030], r10, sp + 0x70);
  49.     r8 = 0x55dd0;
  50.     vm_read_overwrite(*r8, stack[2030], 0x4, sp + 0x94, sp + 0x34);
  51.     r5 = "Original value 0x%08x\n";
  52.     _logToFile(r5, r6, 0x4, sp + 0x94);
  53.     stack[2005] = r10;
  54.     asm { bfi        r4, sl, #0x8, #0x8 };
  55.     vm_write(*r8, stack[2030], sp + 0x34, 0x4);
  56.     vm_read_overwrite(*r8, stack[2030] + 0x14, 0x4, sp + 0x94, sp + 0x34);
  57.     r4 = r6;
  58.     _logToFile(r5, r4, 0x4, sp + 0x94);
  59.     r0 = stack[2030];
  60.     r2 = sp + 0x34;
  61.     r3 = 0x4;
  62.     asm { bfi        r4, sl, #0x8, #0x8 };
  63.     r10 = stack[2005];
  64.     vm_write(*r8, r0 + 0x14, r2, r3);
  65.     strdup("/dev/disk0s1s1");
  66.     _logToFile("Mount succeeded? %d\n", mount("hfs", "/", 0x10000, sp + 0x6c), 0x10000, sp + 0x6c);
  67.     r5 = [objc_msgSend(@class(NSNotificationCenter), stack[2007]) retain];
  68.     r7 = r7;
  69.     r4 = [objc_msgSend(@class(NSDictionary), stack[2008], sp + 0x68, sp + 0x64, 0x1, stack[2003], stack[2004], stack[2005], stack[2006], stack[2007], stack[2008], stack[2009], stack[2010], stack[2011], stack[2012], stack[2013], stack[2014], r4, stack[2016], stack[2017], stack[2018], stack[2019], stack[2020], stack[2021], stack[2022], stack[2023], stack[2024]) retain];
  70.     objc_msgSend(r5, stack[2006]);
  71.     [r4 release];
  72.     [r5 release];
  73.     r4 = stack[2010];
  74.     _find_amfi_patch_offsets(r4, r11, r10, sp + 0x60, sp + 0x5c);
  75.     asm { ldrd       r2, r1, [sp, #0xb0 + var_54] };
  76.     _logToFile("What we hacked: 0x%08x 0x%08x\n", r1, r2, r3);
  77.     vm_write(*r8, stack[2026], sp + 0x34, 0x4);
  78.     _find_i_can_has_debugger_patch_off(r4, r11, r10, sp + 0x58);
  79.     _logToFile("I can has debugger dst: 0x%08x\n", stack[2024], r10, sp + 0x58);
  80.     vm_write(*r8, stack[2024], sp + 0x34, 0x4);
  81.     r11 = stack[2004];
  82.     r1 = stack[2024] + 0x55;
  83.     if (vm_write(r11, r1, "Marijuan", 0x8) != 0x0) {
  84.             _logToFile("failed write kernel\n", r1, "Marijuan", 0x8);
  85.     }
  86.     _find_amfi_substrate_patch(stack[2010], stack[2009], r10, sp + 0x54);
  87.     _find_real_vm_map_enter_patch(stack[2010], stack[2009], r10, sp + 0x50, sp + 0x4c);
  88.     _find_real_vm_map_protect_patch(stack[2010], stack[2009], r10, sp + 0x48);
  89.     asm { ldrd       r2, r1, [sp, #0xb0 + var_60] };
  90.     asm { ldrd       r6, r3, [sp, #0xb0 + var_68] };
  91.     _logToFile("Found a bunch of shit, amfi substrate: 0x%08x, vm map enter 0x%08x 0x%08x, vm_map_protect 0x%08x\n", r1, r2, r3);
  92.     r1 = vm_write(r11, stack[2023], 0x4fe80, 0x2);
  93.     if (r1 != 0x0) {
  94.             _logToFile("Something went wrong vm writing amfi substrate HACK: %d\n", r1, 0x4fe80, 0x2);
  95.     }
  96.     r1 = vm_write(r11, stack[2022], 0x4fe80, 0x2);
  97.     if (r1 != 0x0) {
  98.             _logToFile("Something went wrong vm writing vm map enter HACK: %d\n", r1, 0x4fe80, 0x2);
  99.     }
  100.     r8 = 0x55dd0;
  101.     vm_write(*r8, stack[2021], sp + 0x34, 0x4);
  102.     vm_write(*r8, stack[2020], sp + 0x34, 0x4);
  103.     stack[2003] = sp + 0x3c;
  104.     r0 = sp + 0x40;
  105.     stack[2002] = r0;
  106.     asm { ldrd       r1, r0, [sp, #0xb0 + var_94] };
  107.     _find_another_amfi_hack(r0, r1, r10, sp + 0x44, stack[2002], stack[2003]);
  108.     asm { ldrd       r3, r2, [sp, #0xb0 + var_74] };
  109.     _logToFile("0x%08x 0x%08x 0x%08x\n", stack[2019], r2, r3);
  110.     vm_read_overwrite(r11, stack[2019], 0x8, sp + 0x34, sp + 0x30);
  111.     r10 = stack[2037];
  112.     _logToFile("where we will write MALWARE to: 0x%08x\n", r10, 0x8, sp + 0x34);
  113.     vm_write(*r8, stack[2019], sp + 0x94, 0x4);
  114.     vm_write(*r8, stack[2019] + 0x4, sp + 0x94, 0x4);
  115.     r1 = r10;
  116.     if (vm_write(r11, r1, 0x4fe83, 0x10) != 0x0) {
  117.             _logToFile("Hacked FAILED\n", r1, 0x4fe83, 0x10);
  118.     }
  119.     r8 = 0x55dd0;
  120.     vm_write(r11, r10 + 0x10, sp + 0x34, 0x8);
  121.     r5 = [[NSNotificationCenter defaultCenter] retain];
  122.     asm { strd       r1, r0, [sp, #0xb0 + var_88] };
  123.     r4 = [objc_msgSend(@class(NSDictionary), stack[2008]) retain];
  124.     r11 = 0x0;
  125.     objc_msgSend(r5, stack[2006]);
  126.     [r4 release];
  127.     [r5 release];
  128.     r10 = stack[2010];
  129.     r6 = stack[2009];
  130.     r5 = stack[2005];
  131.     _find_tfp_off(r10, r6, r5, sp + 0x24);
  132.     r1 = stack[2011];
  133.     r2 = sp + 0x94;
  134.     asm { strd       fp, fp, [sp, #0xb0 + var_20] };
  135.     vm_read_overwrite(*r8, r1, 0x4, sp + 0x90, r2);
  136.     r4 = sp + 0x94;
  137.     vm_write(*r8, stack[2011], r4, 0x4);
  138.     _logToFile("patched pid_check\n", stack[2011], r4, 0x4);
  139.     r0 = _find_cs_enforcement_disable_amfi();
  140.     asm { strd       fp, fp, [sp, #0xb0 + var_20] };
  141.     vm_read_overwrite(*r8, r0 + r10, 0x4, sp + 0x90, r4);
  142.     vm_write(*r8, r0 + r10, sp + 0x94, 0x4);
  143.     _find_sbops(r10, r6, r5, sp + 0x90);
  144.     _logToFile("Found sbops 0x%08x\n", stack[2038], r5, sp + 0x90);
  145.     vm_write(*r8, stack[2038] + 0x90, sp + 0x94, 0x4);
  146.     vm_write(*r8, stack[2038] + 0x1e0, sp + 0x94, 0x4);
  147.     vm_write(*r8, stack[2038] + 0x1e0, sp + 0x94, 0x4);
  148.     vm_write(*r8, stack[2038] + 0x3f0, sp + 0x94, 0x4);
  149.     vm_write(*r8, stack[2038] + 0x3f8, sp + 0x94, 0x4);
  150.     vm_write(*r8, stack[2038] + 0x3fc, sp + 0x94, 0x4);
  151.     vm_write(*r8, stack[2038] + 0x400, sp + 0x94, 0x4);
  152.     r1 = stack[2038];
  153.     r2 = sp + 0x94;
  154.     r0 = *r8;
  155.     r3 = 0x4;
  156.     asm { addw       r1, r1, #0x404 };
  157.     vm_write(r0, r1, r2, r3);
  158.     vm_write(*r8, stack[2038] + 0x408, sp + 0x94, 0x4);
  159.     r1 = stack[2038];
  160.     r2 = sp + 0x94;
  161.     r0 = *r8;
  162.     r3 = 0x4;
  163.     asm { addw       r1, r1, #0x40c };
  164.     vm_write(r0, r1, r2, r3);
  165.     vm_write(*r8, stack[2038] + 0x410, sp + 0x94, 0x4);
  166.     r1 = stack[2038];
  167.     r2 = sp + 0x94;
  168.     r0 = *r8;
  169.     r3 = 0x4;
  170.     asm { addw       r1, r1, #0x414 };
  171.     vm_write(r0, r1, r2, r3);
  172.     vm_write(*r8, stack[2038] + 0x420, sp + 0x94, 0x4);
  173.     r1 = stack[2038];
  174.     r2 = sp + 0x94;
  175.     r0 = *r8;
  176.     r3 = 0x4;
  177.     asm { addw       r1, r1, #0x424 };
  178.     vm_write(r0, r1, r2, r3);
  179.     r1 = stack[2038];
  180.     r2 = sp + 0x94;
  181.     r0 = *r8;
  182.     r3 = 0x4;
  183.     asm { addw       r1, r1, #0x42c };
  184.     vm_write(r0, r1, r2, r3);
  185.     vm_write(*r8, stack[2038] + 0x438, sp + 0x94, 0x4);
  186.     r1 = stack[2038];
  187.     r2 = sp + 0x94;
  188.     r0 = *r8;
  189.     r3 = 0x4;
  190.     asm { addw       r1, r1, #0x44c };
  191.     vm_write(r0, r1, r2, r3);
  192.     vm_write(*r8, stack[2038] + 0x450, sp + 0x94, 0x4);
  193.     r1 = stack[2038];
  194.     r2 = sp + 0x94;
  195.     r0 = *r8;
  196.     r3 = 0x4;
  197.     asm { addw       r1, r1, #0x454 };
  198.     vm_write(r0, r1, r2, r3);
  199.     vm_write(*r8, stack[2038] + 0x458, sp + 0x94, 0x4);
  200.     r1 = stack[2038];
  201.     r2 = sp + 0x94;
  202.     r0 = *r8;
  203.     r3 = 0x4;
  204.     asm { addw       r1, r1, #0x45c };
  205.     vm_write(r0, r1, r2, r3);
  206.     vm_write(*r8, stack[2038] + 0x460, sp + 0x94, 0x4);
  207.     vm_write(*r8, stack[2038] + 0x460, sp + 0x94, 0x4);
  208.     r1 = stack[2038];
  209.     r2 = sp + 0x94;
  210.     r0 = *r8;
  211.     r3 = 0x4;
  212.     asm { addw       r1, r1, #0x464 };
  213.     vm_write(r0, r1, r2, r3);
  214.     vm_write(*r8, stack[2038] + 0x468, sp + 0x94, 0x4);
  215.     r1 = stack[2038];
  216.     r2 = sp + 0x94;
  217.     r0 = *r8;
  218.     r3 = 0x4;
  219.     asm { addw       r1, r1, #0x46c };
  220.     vm_write(r0, r1, r2, r3);
  221.     r1 = stack[2038];
  222.     r2 = sp + 0x94;
  223.     r0 = *r8;
  224.     r3 = 0x4;
  225.     asm { addw       r1, r1, #0x4bc };
  226.     vm_write(r0, r1, r2, r3);
  227.     vm_write(*r8, stack[2038] + 0x4f0, sp + 0x94, 0x4);
  228.     vm_write(*r8, stack[2038] + 0x3d4, sp + 0x94, 0x4);
  229.     r0 = vm_write(*r8, stack[2038] + 0x168, sp + 0x94, 0x4);
  230.     return r0;
  231. }

Reply to "Untitled"