Hacker News Reader

Hacker News

Comment by zuck9 | Hacker News Reader

Full thread

zuck9

What does it look like when it crashes on iOS? Does just the app crash, springboard crashes or the device restarts?

View on HN

The screen turns blue – yes, blue, not joking – for a brief moment, and the system reboots. :)

Is it 64-bit only? Which hardware are you using for this test?

EDIT:

I cannot reproduce on iPhone 5 which is NOT running any 64-bit kernel.

I only tested it on 64-bit systems, where it triggers the kernel panic from both 32- and 64-bit processes (i386, x86_64, arm, and arm64). Hardware-wise it crashes every single device I've tried (MacBook Pro, iMac, iPhone 6, etc.), so this is not tied to any specific hardware.

Aha, interesting. Does the program crash or exit gracefully?

Debugging with lldb: no crash; Running from springboard: EXC_BAD_ACCESS (SIGKILL - CODESIGNING)

Just heard from Tyilo, in #frida on irc.freenode.net, that replacing mach_vm_* with vm_* makes the test-case work on 32-bit devices, where apparently mach_vm_* are missing.

Just tried with iOS 8.1 SDK. It seems that <mach/mach_vm.h> is not supported on iOS. So far, I failed to reproduce the crash/kernel panic with code snippet from the original post.

It is supported, just need an expanded SDK or you can provide the OS X variant of mach_vm.h and import that.

But clang did not treat it as an error when I commented the #include line. I have no idea if it was actually dynamically linked.

Includes don't control linking, and traditional C did not require function prototypes, so most compilers (in non-C++ mode at least) will happily compile calls to unknown functions, it just assumes a default signature.

I know that and mach_* are supposed to be dynamically loaded. But what I failed to get is to reproduce the kernel panic, not to build and run on my iPhone 5. By now that piece of code could run but only result in normal crash, not kernel panic.

The mach_vm.h header has been replaced with a dummy version in recent iOS SDKs, so you’ll have to copy it from your OS X SDK and adjust the include. Just updated the post, and also removed VM_PROT_EXECUTE from the mach_vm_protect call for compatibility with non-jailbroken devices.

It does not crashes iOS 8.3.

Interesting, that's potentially very good news! To be sure, could you try again with the latest code snippet? I forgot to remove the VM_PROT_EXECUTE flag for non-jailbroken devices.

No kernel panic, EXC_BAD_ACCESS in Debug/Release confs.

Possibly I have provided wrong prototypes, mach_vm is n/a in iOS: https://gist.github.com/cfr/425812debdb2a6d0449f

Where does it crash? Try bumping the argument on line 21 – if you're unlucky library at index 1 contains mach_vm_read_overwrite and is suddenly no longer executable (since we change its second memory page from R-X to RW- due to stock kernels not allowing RWX pages).

Yes, it crashes with kernel panic now.

Yay!

Reply on news.ycombinator.com