开源软件名称（OpenSource Name）：slavaim/MacOSX-IOKit-Hooker开源软件地址(OpenSource Url)：https://github.com/slavaim/MacOSX-IOKit-Hooker开源编程语言(OpenSource Language)：C++ 90.1%开源软件介绍(OpenSource Introduction)：MacOSX-IOKit-HookerLicenseThe license model is a BSD Open Source License. This is a non-viral license, only asking that if you use it, you acknowledge the authors, in this case Slava Imameev. FeaturesThis is a hooker for macOS (Mac OS X) IOKit class objects. This hooker is a part of a bigger project MacOSX-Kernel-Filter https://github.com/slavaim/MacOSX-Kernel-Filter. I extracted the hooker related code and removed unrelated dependencies to make it easy to incorporate the hooker for new projects. The repository contains an IOKit module project that is provided only for your convinience so you can check that files can be compiled as a standalone project in your build environment. The src directory contains the hooker code. The example directory contains an example of hooker implementation for IOUserClient derived objects. Apple I/O Kit is a set of classes to develop kernel modules for Mac OS X and iOS. Its analog in the Windows world is KMDF/UMDF framework. I/O Kit is built atop Mach and BSD subsystems like Windows KMDF is built atop WDM and kernel API. The official way to develop a kernel module filter for Mac OS X and iOS is to inherit filter C++ class from a C++ class it filters. This requires access to a class declaration which is not always possible as some classes are Apple private or not published by a third party developers. In most cases all these private classes are inherited from classes that are in the public domain. That means they extend an existing interface/functionality and a goal to filter device I/O can be achieved by filtering only the public interface. This is nearly always true because an I/O Kit class object that is attached to this private C++ class object is usually an Apple I/O Kit class that knows nothing about the third party extended interface or is supposed to be from a module developed by third party developers and it knows only about a public interface. In both cases the attached object issues requests to a public interface. Let's consider some imaginary private class IOPrivateInterface that inherits from some IOAppleDeviceClass which declaration is available and an attached I/O Kit object issues requests to IOAppleDeviceClass interface
You want to filter requests to a device managed by IOPrivateInterface, that means that you need to declare your filter like
this would never compile as you do not have access to IOPrivateInterface class. You can't declare you filter as
as this will jettison all IOPrivateInterface code and the device will not function correctly. There might be another reason to avoid standard I/O Kit filtering by inheritance. A filtering class objects replaces an original class object in the I/O Kit device stack. That means a module with a filter should be available on device discovery and initialization. In nearly all cases this means that an instance of a filter class object will be created during system startup. This puts a great responsibility on a module developer as an error might render the system unbootable without an easy solution for a customer to fix the problem. To overcome these limitations I developed a hooking technique for I/O kit classes. I/O Kit uses virtual C++ functions so a class can be extended but its clients still be able to use a base class declaration. That means that all functions that used for I/O are placed in the array of function pointers known as vtable. The hooking technique supports two types of hooking.
The former method allows to filter access to a particular object of a class but requires knowing a vtable size. The latter method allows to filter request without knowing vtable size but as vtable is shared by all objects of a class a filter will see requests to all objects of a particular class. To get a vtable size you need a class declaration or get the size by reverse engineering. The hooker code can be found in DldHookerCommonClass.cpp . The driver uses C++ templates to avoid code duplication. Though Apple documentation declares that C++ templates are not supported by I/O Kit it is true only if a template is used to declare I/O kit object. You can compile I/O kit module with C++ template classes if they are not I/O Kit classes but template parameters can be I/O Kit classes. As you probably know after instantiation a template is just an ordinary C++ class. Template classes support is not required from run time environment. You can't declare I/O Kit class as a template just because a way Apple declares them by using C style preprocessor definitions. Below is a call stack when a hooked I/O Kit object virtual function is called by IOStorage::open InternalsHooking is performed by a call to there are two hooking types The both hooking types result in calling DldHookVtableFunctions that replaces function pointers in Vtable In case of DldHookTypeObject type a new Vtable is allocated and replaces an original object's Vtable after a call to DldHookVtableFunctions. For DldHookTypeVtable type VtableToHook is equal to NewVtable so an original Vtable is being patched with hooking functions. The Vtable patching is performed by a call to DldWriteWiredSrcToWiredDst is used to map a read only page(PTE is marked as read only) to a local CPU mapping as read/write PTE as for some objects a Vtable might be allocated in read only memory. UsageThe project contains an example of hooker usage for IOUserClient objects. For particular details look at HookExample function that initiates hooking for IOUserClient derived objects. Below is a brief description for IOUserClient hook and DldIOKitHookEngine. DldIOKitHookEngine is a class that registers and applies hooks by traversing the IOService plane. You can extend this example by adding dynamic hooking for newly created objects, see MacOSX-Kernel-Filter for details. The hooking is performed by which applies a hooking function for each registered class The template class defines a hooker for IOUserClient derived classes up to Depth of inheritance. This template is instantiated by DldIOKitHookEngine::startHookingWithPredefinedClasses as the static object of a class is created by a call to fStaticContainerClassInstance this static object is used to hook IOUserClient inherited objects by providing hooking functions registered by init() routine The enumerator type defines index for each virtual function hook Then goes a definition for each hooking function The actual object hooking is performed by an instance of DldHookerCommonClass2 class template which provides fHookObject function You need to provide a template class similar for IOUserClientDldHook for each IOKit class you want to hook. For example below is a class declaration for IOUSBMassStorageClass 
|
2023-10-27
2022-08-15
2022-08-17
2022-09-23
2022-08-13
六六分期app的软件客服如何联系？不知道吗？加qq群【895510560】即可！标题：六六分期
今天小编告诉大家如何处理win10系统火狐flash插件总是崩溃的问题，可能很多用户都不知
今天小编告诉大家如何对win10系统删除桌面回收站图标进行设置，可能很多用户都不知道
今天小编告诉大家如何对win10系统电脑设置节能降温的设置方法，想必大家都遇到过需要
我们在使用xp系统的过程中,经常需要对xp系统无线网络安装向导设置进行设置，可能很多
今天小编告诉大家如何处理win7系统玩cf老是与主机连接不稳定的问题，可能很多用户都不
电脑对日常生活的重要性小编就不多说了，可是一旦碰到win7系统设置cf烟雾头的问题，很
我们在日常使用电脑的时候，有的小伙伴们可能在打开应用的时候会遇见提示应用程序无法
今天小编告诉大家如何对win7系统打开vcf文件进行设置，可能很多用户都不知道怎么对win
今天小编告诉大家如何对win10系统s4开启USB调试模式进行设置，可能很多用户都不知道怎
请发表评论