Difference between revisions of "Tfp0 patch"

From The iPhone Wiki
Jump to: navigation, search
(Created page with "{{DISPLAYTITLE:task-for-pid0 Patch}} * task_for_pid requires entitlements 'get-task-allow' to make AMFI happy. * task_for_pid cannot get kernel_task without a patch. * Thi...")
 
(+lede, +example code, “task_for_pid-allow” is needed on iOS 6 (but not “get-task-allow”, will test on higher versions later))
Line 1: Line 1:
{{DISPLAYTITLE:task-for-pid0 Patch}}
+
{{DISPLAYTITLE:tfp0 patch}}
  +
In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.
* task_for_pid requires entitlements 'get-task-allow' to make [[AMFI]] happy.
 
  +
* task_for_pid cannot get kernel_task without a patch.
 
  +
== Example code ==
* This patch allows you to get the kernel Mach task, you can then use vm_read and vm_write to modify the kernel VM region.
 
  +
The following C program calls <code>task_for_pid</code> and returns the error code:
  +
  +
#include <mach/mach.h>
  +
  +
// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
  +
// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0
  +
  +
int main(void) {
  +
mach_port_t kernel_task = 0;
  +
return task_for_pid(mach_task_self(), 0, &kernel_task);
  +
}
  +
  +
The returned error code, which can be checked using <code>echo $?</code> in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see <code>kern_return.h</code> for possible values). The entitlements plist (named <code>tfp0.plist</code> in this example) for [[ldid]] can look like this:
  +
  +
<?xml version="1.0" encoding="UTF-8"?>
  +
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">
  +
<plist version="1.0">
  +
<dict>
  +
<key>get-task-allow</key>
  +
<true/>
  +
<key>run-unsigned-code</key>
  +
<true/>
  +
<key>task_for_pid-allow</key>
  +
<true/>
  +
</dict>
  +
</plist>
  +
 
[[Category:Kernel Patches]]
 
[[Category:Kernel Patches]]

Revision as of 23:14, 25 December 2017

In the XNU kernel, task_for_pid is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A tfp0 patch (or task_for_pid(0) patch) removes this restriction, allowing any executable to call task_for_pid for pid 0 (hence the name) and then use vm_read and vm_write to modify the kernel VM region. The entitlements get-task-allow and task_for_pid-allow are required to make AMFI happy.

Example code

The following C program calls task_for_pid and returns the error code:

#include <mach/mach.h>

// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0

int main(void) {
    mach_port_t kernel_task = 0;
    return task_for_pid(mach_task_self(), 0, &kernel_task);
}

The returned error code, which can be checked using echo $? in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see kern_return.h for possible values). The entitlements plist (named tfp0.plist in this example) for ldid can look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>get-task-allow</key>
    <true/>
    <key>run-unsigned-code</key>
    <true/>
    <key>task_for_pid-allow</key>
    <true/>
</dict>
</plist>