Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Idea][MacOS] Bypass page lockdown #9

Open
Nemirtingas opened this issue Aug 2, 2024 · 0 comments
Open

[Idea][MacOS] Bypass page lockdown #9

Nemirtingas opened this issue Aug 2, 2024 · 0 comments

Comments

@Nemirtingas
Copy link
Owner

Nemirtingas commented Aug 2, 2024

Could use the following code to thread_suspend all other threads than mach_thread_self, unmap the region you want to hook, write the hook and remap the region.

    auto task = mach_task_self();

    thread_act_array_t threads;
    mach_msg_type_number_t thread_count;
    kern_return_t kr = task_threads(task, &threads, &thread_count);

    thread_t thread = MACH_PORT_NULL;

    std::cout << "Thread count: " << thread_count << std::endl;
    for (long i = thread_count - 1; thread == MACH_PORT_NULL && i >= 0; i--)
    {
        thread_t this_thread = mach_thread_self();
        std::cout << "This thread: " << this_thread << ", current thread: " << threads[i] << std::endl;
    }

    for (size_t i = 0; i < thread_count; i++)
        mach_port_deallocate(task, threads[i]);

    mach_vm_deallocate(task, (mach_vm_address_t) threads, thread_count * sizeof(*threads));

To be noted, the first thread's id seems to always be 259.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant