Serotonin icon indicating copy to clipboard operation
Serotonin copied to clipboard

SwitchBin() seems not work at /usr/libexec/

Open ArchCangyuan opened this issue 1 year ago • 2 comments

I tried to call SwitchSysBin() and hook executable binaries at /usr/libexec/, it seems that at most time the the binaries in the path cannot be enumerated (kread64(vp_namecache + off_namecache_nc_vp) = 0). Sometimes when it successfully finds and hooks the namecache of the binary (I tried nfcd), the kernel get panic after rebooting.

"panicString" : "panic(cpu 2 caller 0xfffffff027364670): vnode_drop_internal : vp 0xffffffe1c63c4800 holdcount -ve: -1. v_tag = 0, v_type = 8, v_flag = 84800. @vfs_subr.c:5915\nDebugger message: panic\nMemory ID: 0x6\nOS release type: User\nOS version: 20G75\nKernel version: Darwin Kernel Version 22.6.0: Wed Jun 28 20:51:23 PDT 2023;

ArchCangyuan avatar Jan 18 '24 14:01 ArchCangyuan