mach_inject icon indicating copy to clipboard operation
mach_inject copied to clipboard

Not able to Inject on Mac OS X 10.12.6 & Mac OS X 10.13 (17A291j) Beta release

Open doshisahil opened this issue 7 years ago • 2 comments

When I inject into the process using mach_inject, that application crashes. I have observed this behaviour with one of my 10.12.6 machine(Not reproducible on all 10.12.6) and Mac OS X 10.13 (17A291j) Beta release of 10.13.

When the following code executes

// create thread and launch it
		err = thread_create_running( remoteTask, x86_THREAD_STATE64,
									 (thread_state_t) &remoteThreadState, x86_THREAD_STATE64_COUNT,
									 &remoteThread );

Application in which i am injecting get crashed.

On 10.12 when I disabled SIP, Issue vanished. and now not able to reproduce it even after re-enabling SIP.

doshisahil avatar Aug 11 '17 09:08 doshisahil

Were you able to inject on 10.11? I thought in 10.11 they started this non-inject system security thing, and to flip that switch you have to restart computer nad hit like F8 while computer is starting, some comlicated thing, "System Integrity" i think its called.

Noitidart avatar Aug 11 '17 13:08 Noitidart

@Noitidart , never had issue with 10.11. and even this issue is not with all machines. and yes it seems to get resolved by Disabling System Integrity Protection (SIP) once. Now if i reenable it, my injection works properly.

doshisahil avatar Aug 12 '17 07:08 doshisahil