Skip to content

Commit cfb4448

Browse files
opa334opa334
committed
Rework forkfix on iOS 15 arm64e: Fully reimplement fork, vfork, daemon and forkpty so that no more function hook is neccessary
1 parent c0bcc79 commit cfb4448

File tree

4 files changed

+199
-39
lines changed

4 files changed

+199
-39
lines changed

‎BaseBin/forkfix/src/main.c

+2-38
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
#include <util.h>
99
#include "syscall.h"
1010
#include "litehook.h"
11+
#include "reimpl.h"
1112
#include <libjailbreak/jbclient_xpc.h>
1213

1314
extern void _malloc_fork_prepare(void);
@@ -107,48 +108,11 @@ void apply_fork_hook(void)
107108
});
108109
}
109110

110-
// iOS 15 arm64e wrappers
111-
// Only apply fork hook when something actually calls it
112-
int fork_hook(void)
113-
{
114-
apply_fork_hook();
115-
return fork();
116-
}
117-
int vfork_hook(void)
118-
{
119-
apply_fork_hook();
120-
return vfork();
121-
}
122-
pid_t forkpty_hook(int *amaster, char *name, struct termios *termp, struct winsize *winp)
123-
{
124-
apply_fork_hook();
125-
return forkpty(amaster, name, termp, winp);
126-
}
127-
int daemon_hook(int __nochdir, int __noclose)
128-
{
129-
apply_fork_hook();
130-
return daemon(__nochdir, __noclose);
131-
}
132-
133111
__attribute__((constructor)) static void initializer(void)
134112
{
135113
#ifdef __arm64e__
136114
if (__builtin_available(iOS 16.0, *)) { /* fall through */ }
137-
else {
138-
void *systemhookHandle = dlopen("systemhook.dylib", RTLD_NOLOAD);
139-
if (systemhookHandle) {
140-
// On iOS 15 arm64e, instead of using instruction replacements, rebind everything that calls __fork instead
141-
// Less instruction replacements = Less spinlock panics (DO NOT QUOTE ME ON THIS)
142-
kern_return_t (*litehook_rebind_symbol_globally)(void *source, void *target) = dlsym(systemhookHandle, "litehook_rebind_symbol_globally");
143-
if (litehook_rebind_symbol_globally) {
144-
litehook_rebind_symbol_globally((void *)fork, (void *)fork_hook);
145-
litehook_rebind_symbol_globally((void *)vfork, (void *)vfork_hook);
146-
litehook_rebind_symbol_globally((void *)forkpty, (void *)forkpty_hook);
147-
litehook_rebind_symbol_globally((void *)daemon, (void *)daemon_hook);
148-
}
149-
}
150-
return;
151-
}
115+
else if (fork_reimpl_init(forkfix___fork)) return;
152116
#endif
153117

154118
apply_fork_hook();

‎BaseBin/forkfix/src/reimpl.c

+190
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <stdbool.h>
4+
#include <stdint.h>
5+
#include <unistd.h>
6+
#include <sys/wait.h>
7+
#include <signal.h>
8+
#include <dlfcn.h>
9+
#include <os/log.h>
10+
#include <util.h>
11+
#include <errno.h>
12+
#include <syslog.h>
13+
kern_return_t bootstrap_parent(mach_port_t bp, mach_port_t *parent_port);
14+
void __fork(void);
15+
16+
// There are two functions with direct branches to __fork: fork and vfork
17+
// We want to rebind these to reimplementations that work the same, but call our __forkfix_fork instead
18+
19+
// Additionally, there are also two functions with direct branches to fork: daemon and forkpty
20+
// For these, we want to rebind them to reimplementations that work the same, but call our fork_reimpl instead
21+
22+
// Unfortunately, there is no other option here than to reimplement the functions, since the point is to do no instruction replacements
23+
24+
static int (*__fork_ptr)(void) = NULL;
25+
26+
void (**_libSystem_atfork_prepare)(uint64_t v2Arg) = NULL;
27+
void (**_libSystem_atfork_parent) (uint64_t v2Arg) = NULL;
28+
void (**_libSystem_atfork_child) (uint64_t v2Arg) = NULL;
29+
30+
int fork_reimpl(void)
31+
{
32+
(*_libSystem_atfork_prepare)(0);
33+
int pid = __fork_ptr();
34+
if (pid != 0) {
35+
(*_libSystem_atfork_parent)(0);
36+
}
37+
else {
38+
(*_libSystem_atfork_child)(0);
39+
}
40+
return pid;
41+
}
42+
43+
int vfork_reimpl(void)
44+
{
45+
(*_libSystem_atfork_prepare)(1);
46+
int pid = __fork_ptr();
47+
if (pid != 0) {
48+
(*_libSystem_atfork_parent)(1);
49+
}
50+
else {
51+
(*_libSystem_atfork_child)(1);
52+
}
53+
return pid;
54+
}
55+
56+
static void move_to_root_bootstrap(void)
57+
{
58+
mach_port_t parent_port = 0;
59+
mach_port_t previous_port = 0;
60+
61+
do {
62+
if (previous_port) {
63+
mach_port_deallocate(mach_task_self(), previous_port);
64+
previous_port = parent_port;
65+
} else {
66+
previous_port = bootstrap_port;
67+
}
68+
69+
if (bootstrap_parent(previous_port, &parent_port) != 0) {
70+
return;
71+
}
72+
} while (parent_port != previous_port);
73+
74+
task_set_bootstrap_port(mach_task_self(), parent_port);
75+
bootstrap_port = parent_port;
76+
}
77+
78+
int daemon_reimpl(int nochdir, int noclose)
79+
{
80+
struct sigaction osa, sa;
81+
int fd;
82+
pid_t newgrp;
83+
int oerrno;
84+
int osa_ok;
85+
86+
/* A SIGHUP may be thrown when the parent exits below. */
87+
sigemptyset(&sa.sa_mask);
88+
sa.sa_handler = SIG_IGN;
89+
sa.sa_flags = 0;
90+
osa_ok = sigaction(SIGHUP, &sa, &osa);
91+
move_to_root_bootstrap();
92+
switch (fork_reimpl()) {
93+
case -1:
94+
return (-1);
95+
case 0:
96+
break;
97+
default:
98+
_exit(0);
99+
}
100+
101+
newgrp = setsid();
102+
oerrno = errno;
103+
if (osa_ok != -1)
104+
sigaction(SIGHUP, &osa, NULL);
105+
106+
if (newgrp == -1) {
107+
errno = oerrno;
108+
return (-1);
109+
}
110+
111+
if (!nochdir)
112+
(void)chdir("/");
113+
114+
if (!noclose && (fd = open("/dev/null", O_RDWR, 0)) != -1) {
115+
(void)dup2(fd, STDIN_FILENO);
116+
(void)dup2(fd, STDOUT_FILENO);
117+
(void)dup2(fd, STDERR_FILENO);
118+
if (fd > 2)
119+
(void)close(fd);
120+
}
121+
return (0);
122+
}
123+
124+
int forkpty_reimpl(int *aprimary, char *name, struct termios *termp, struct winsize *winp)
125+
{
126+
int primary, replica, pid;
127+
128+
if (openpty(&primary, &replica, name, termp, winp) == -1)
129+
return (-1);
130+
switch (pid = fork_reimpl()) {
131+
case -1:
132+
(void) close(primary);
133+
(void) close(replica);
134+
return (-1);
135+
case 0:
136+
/*
137+
* child
138+
*/
139+
(void) close(primary);
140+
/*
141+
* 4300297: login_tty() may fail to set the controlling tty.
142+
* Since we have already forked, the best we can do is to
143+
* dup the replica as if login_tty() succeeded.
144+
*/
145+
if (login_tty(replica) < 0) {
146+
syslog(LOG_ERR, "forkpty: login_tty could't make controlling tty");
147+
(void) dup2(replica, 0);
148+
(void) dup2(replica, 1);
149+
(void) dup2(replica, 2);
150+
if (replica > 2)
151+
(void) close(replica);
152+
}
153+
return (0);
154+
}
155+
/*
156+
* parent
157+
*/
158+
*aprimary = primary;
159+
(void) close(replica);
160+
return (pid);
161+
}
162+
163+
bool fork_reimpl_init(void *fork_ptr)
164+
{
165+
if (!fork_ptr) return false;
166+
167+
__fork_ptr = fork_ptr;
168+
169+
void *systemhookHandle = dlopen("systemhook.dylib", RTLD_NOLOAD);
170+
if (!systemhookHandle) return false;
171+
172+
kern_return_t (*litehook_rebind_symbol_globally)(void *source, void *target) = dlsym(systemhookHandle, "litehook_rebind_symbol_globally");
173+
void *(*litehook_find_dsc_symbol)(const char *imagePath, const char *symbolName) = dlsym(systemhookHandle, "litehook_find_dsc_symbol");
174+
if (!litehook_rebind_symbol_globally || !litehook_find_dsc_symbol) return false;
175+
176+
// The v2 functions take one argument, but we can still store them in the same pointer since the argument will just be discarded if the non v2 implementation is used
177+
// In practice, the v2 implementation should always exist, since we're not dealing with super old versions, so all of this doesn't matter too much
178+
const char *libcpath = "/usr/lib/system/libsystem_c.dylib";
179+
_libSystem_atfork_prepare = litehook_find_dsc_symbol(libcpath, "__libSystem_atfork_prepare_v2") ?: litehook_find_dsc_symbol(libcpath, "__libSystem_atfork_prepare");
180+
_libSystem_atfork_parent = litehook_find_dsc_symbol(libcpath, "__libSystem_atfork_parent_v2") ?: litehook_find_dsc_symbol(libcpath, "__libSystem_atfork_parent");
181+
_libSystem_atfork_child = litehook_find_dsc_symbol(libcpath, "__libSystem_atfork_child_v2") ?: litehook_find_dsc_symbol(libcpath, "__libSystem_atfork_child");
182+
183+
litehook_rebind_symbol_globally((void *)__fork, (void *)__fork_ptr);
184+
litehook_rebind_symbol_globally((void *)fork, (void *)fork_reimpl);
185+
litehook_rebind_symbol_globally((void *)vfork, (void *)vfork_reimpl);
186+
litehook_rebind_symbol_globally((void *)daemon, (void *)daemon_reimpl);
187+
litehook_rebind_symbol_globally((void *)forkpty, (void *)forkpty_reimpl);
188+
189+
return true;
190+
}

‎BaseBin/forkfix/src/reimpl.h

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
int fork_reimpl(void);
2+
int vfork_reimpl(void);
3+
int daemon_reimpl(int nochdir, int noclose);
4+
int forkpty_reimpl(int *aprimary, char *name, struct termios *termp, struct winsize *winp);
5+
6+
bool fork_reimpl_init(void *fork_ptr);

‎BaseBin/launchdhook/src/boomerang.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,6 @@ int boomerang_recoverPrimitives(bool firstRetrieval, bool shouldEndBoomerang)
9797
waitpid(boomerangPid, &boomerangStatus, 0);
9898
}
9999
}
100-
100+
101101
return 0;
102102
}

0 commit comments

Comments
 (0)