Difference between revisions of "Vm map protect Patch"

From The iPhone Wiki
Jump to: navigation, search
(another public patch copied from Stefan Essers slides)
 
m (switch to subcategories)
 
(2 intermediate revisions by the same user not shown)
Line 8: Line 8:
 
__text:8003E980 loc_8003E980 ; CODE XREF: _vm_map_protect+92↑j
 
__text:8003E980 loc_8003E980 ; CODE XREF: _vm_map_protect+92↑j
 
__text:8003E980 LDR R1, =aVm_map_protect ; "vm_map_protect"
 
__text:8003E980 LDR R1, =aVm_map_protect ; "vm_map_protect"
__text:8003E980 BL sub_8001A9E0
+
__text:8003E982 BL sub_8001A9E0
__text:8003E980 BIC.W R5, R5, #4 <== replaced with NOP
+
__text:8003E986 BIC.W R5, R5, #4 <== replaced with NOP
__text:8003E980 B loc_8003E944
+
__text:8003E98A B loc_8003E944
__text:8003E980 ; ---------------------------------------------------------------------------
+
__text:8003E98C ; ---------------------------------------------------------------------------
[[Category:Patches]]
+
[[Category:Kernel Patches]]

Latest revision as of 07:12, 3 October 2011

  • vm_map_protect disallows pages with both VM_PROT_WRITE and VM_PROT_EXECUTE
  • when found VM_PROT_EXECUTE is cleared
  • patch NOPs out the bit clearing
__text:8003E980 ; ---------------------------------------------------------------------------
__text:8003E980 
__text:8003E980 loc_8003E980                            ; CODE XREF: _vm_map_protect+92↑j
__text:8003E980                 LDR             R1, =aVm_map_protect ; "vm_map_protect"
__text:8003E982                 BL              sub_8001A9E0
__text:8003E986                 BIC.W           R5, R5, #4 <== replaced with NOP
__text:8003E98A                 B               loc_8003E944
__text:8003E98C ; ---------------------------------------------------------------------------