Serotonin icon indicating copy to clipboard operation
Serotonin copied to clipboard

Patchfinder does not set correct values for fileglob__fg_ops and proc__p_fd__fd_ofiles

Open anthonyjr2 opened this issue 1 year ago • 5 comments

Not sure if this was fixed in the port to iOS but there was a bug where these two offsets are output incorrectly using libpatchfinder. These are the correct values they should have (for A12 iPads at least, not sure if it is different for anything else). This fixed kernel panics with landa on both of my devices.

fileglob__fg_ops 0x0 -> 0x28 proc__p_fd__fd_ofiles 0x0 -> 0xf8

anthonyjr2 avatar Jan 09 '24 15:01 anthonyjr2

this lines up for where I found the issue to be (last thing in stack trace before error) https://github.com/mineek/Serotonin/blob/ddeff5a4ec97e4aca2dd4e46ab7f6135fa9afb65/usprebooter/libkfd/krkw.h#L151

jonahnm avatar Jan 09 '24 15:01 jonahnm

No wait I take it back, the error is happening in "objc_autoreleasePoolPop". With error "(Data Abort) byte read Translation fault".

jonahnm avatar Jan 09 '24 15:01 jonahnm

The patchfinder isn't even supposed to find these values, they're still hardcoded in dynamic_info.h. The patchfinder only finds per-kernelcache addresses... And from checking it those values are already there, what iOS version exactly?

mineek avatar Jan 09 '24 16:01 mineek

Ah, I didn't know you were still using dynamic_info.h with the patchfinder. This is for iOS 16.2 on iPad8,3.

EDIT: Just noticed how the dynamic_info is setup different now. Not sure what the issue would be but I do have the offsets on hand that worked successfully on PureKFD

EDIT2: Only thing I see different in my offsets is: .uthread__object_size = 0xfffffffffffffb58, ._vm_map__object_size = 0x0,

Not sure if that's related to it panicking.

anthonyjr2 avatar Jan 09 '24 16:01 anthonyjr2

heya! try the new PR!

jonahnm avatar Jan 12 '24 01:01 jonahnm