fix some issues (#281)

* fix some issues * add header for forkpty
opa334 · Nov 20, 2023 · 5d66528 · 5d66528
1 parent ee039cb
commit 5d66528
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 2 deletions.
diff --git a/BaseBin/libjailbreak/src/kcall.m b/BaseBin/libjailbreak/src/kcall.m
@@ -273,7 +273,7 @@ uint64_t initPACPrimitives(uint64_t kernelAllocation)
 	kwrite64(actContext + offsetof(kRegisterState, x[17]), brX22);
 
 	// Use str x8, [x9] gadget to set TH_KSTACKPTR
-	kwrite64(actContext + offsetof(kRegisterState, x[8]), stack + 0x10ULL);
+	kwrite64(actContext + offsetof(kRegisterState, x[8]), stack + 0x1000ULL);
 	kwrite64(actContext + offsetof(kRegisterState, x[9]), threadPtr + bootInfo_getUInt64(@"TH_KSTACKPTR"));
 
 	// SP and x0 should both point to the new CPU state

diff --git a/BaseBin/libjailbreak/src/macho.m b/BaseBin/libjailbreak/src/macho.m
@@ -70,6 +70,10 @@ int64_t machoFindArch(FILE *machoFile, uint32_t subtypeToSearch)
 		fseek(machoFile, archOffset, SEEK_SET);
 		fread(&mh, sizeof(mh), 1, machoFile);
 		uint32_t maskedSubtype = OSSwapLittleToHostInt32(mh.cpusubtype);
+
+		if(OSSwapLittleToHostInt32(mh.filetype)==MH_EXECUTE && maskedSubtype==CPU_SUBTYPE_ARM64E)
+			return; //skip arm64e old ABI for executable on ios15
+
 		if (maskedSubtype == subtypeToSearch) {
 			outArchOffset = archOffset;
 			*stop = YES;

diff --git a/BaseBin/systemhook/src/main.c b/BaseBin/systemhook/src/main.c
@@ -5,6 +5,7 @@
 #include <sys/sysctl.h>
 #include <sys/stat.h>
 #include <paths.h>
+#include <util.h>
 #include "sandbox.h"
 extern char **environ;
 
@@ -129,6 +130,12 @@ int execve_hook(const char *path, char *const argv[], char *const envp[])
 	if (attr) {
 		posix_spawnattr_destroy(&attr);
 	}
+
+	if(result != 0) { // posix_spawn will return errno and restore errno if it fails
+		errno = result; // so we need to set errno by ourself
+		return -1;
+	}
+
 	return result;
 }
 
@@ -361,6 +368,18 @@ pid_t vfork_hook(void)
 	return vfork();
 }
 
+pid_t forkpty_hook(int *amaster, char *name, struct termios *termp, struct winsize *winp)
+{
+	loadForkFix();
+	return forkpty(amaster, name, termp, winp);
+}
+
+int daemon_hook(int __nochdir, int __noclose)
+{
+	loadForkFix();
+	return daemon(__nochdir, __noclose);
+}
+
 bool shouldEnableTweaks(void)
 {
 	if (access(JB_ROOT_PATH("/basebin/.safe_mode"), F_OK) == 0) {
@@ -471,3 +490,5 @@ DYLD_INTERPOSE(sandbox_init_with_extensions_hook, sandbox_init_with_extensions)
 DYLD_INTERPOSE(ptrace_hook, ptrace)
 DYLD_INTERPOSE(fork_hook, fork)
 DYLD_INTERPOSE(vfork_hook, vfork)
+DYLD_INTERPOSE(forkpty_hook, forkpty)
+DYLD_INTERPOSE(daemon_hook, daemon)
diff --git a/Exploits/oobPCI/Sources/badRecovery.c b/Exploits/oobPCI/Sources/badRecovery.c
@@ -465,7 +465,7 @@ bool setupFugu14Kcall(void) {
     kwrite64(actContext + offsetof(kRegisterState, x[17]), brX22);
 
     // Use str x8, [x9] gadget to set TH_KSTACKPTR
-    kwrite64(actContext + offsetof(kRegisterState, x[8]), stack + 0x10ULL);
+    kwrite64(actContext + offsetof(kRegisterState, x[8]), stack + 0x1000ULL);
     kwrite64(actContext + offsetof(kRegisterState, x[9]), threadPtr + THREAD_KSTACKPTR_OFFSET);
 
     // SP and x0 should both point to the new CPU state