https://www.theiphonewiki.com/w/api.php?action=feedcontributions&feedformat=atom&user=Bellis1000The iPhone Wiki - User contributions [en]2026-08-06T14:07:42ZUser contributionsMediaWiki 1.31.14https://www.theiphonewiki.com/w/index.php?title=Hgsp4_patch&diff=68490Hgsp4 patch2018-03-31T19:11:27Z<p>Bellis1000: /* hgsp4 enabled jailbreaks */</p>
<hr />
<div>{{DISPLAYTITLE:hgsp4 patch}}<br />
A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel task by calling '''host_get_special_port''' for host special port '''4''' (hence the name). This host special port is usually unused, and the kernel task port must be “mounted” there by an exploit.<ref>https://bazad.github.io/2017/09/live-kernel-introspection-ios/</ref><ref>https://github.com/iabem97/hermes/blob/master/hermes/disable_protections.c</ref> It is thus recommended that host special port 4 be used solely for the kernel task port.<ref>http://www.newosxbook.com/forum/viewtopic.php?f=8&t=16641</ref> <br />
<br />
The hgsp4 route is equivalent to the [[tfp0]] route, and tools that rely on tfp0 can be recompiled to use hgsp4 instead.<ref>[https://twitter.com/panguteam/status/708330906084216833 @PanguTeam: For security researchers, calling host_get_special_port with 4 on jailbroken devices will give u kernel task port just like task_for_pid(0)]</ref> In a tweet, tihmstar confirmed that this applies to [[kloader]] too.<ref>[https://twitter.com/tihmstar/status/945613035489644544 @tihmstar: kloader works fine with h3lix :) Thanks to @nyan_satan for sending me a compiled version which uses hgsp(4)]</ref><br />
<br />
== Example code ==<br />
The following example C program calls <code>host_get_special_port</code> and, on success, returns a positive integer that can be checked using <code>echo $?</code> in bash after running the test program:<br />
<br />
#include <mach/mach.h><br />
<br />
int main(void) {<br />
mach_port_t kernel_task = 0;<br />
if (!host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &kernel_task)) return -1;<br />
return kernel_task;<br />
}<br />
<br />
-1 is returned on error. 0 is returned if no hgsp4 patch is enabled.<br />
<br />
== hgsp4 enabled jailbreaks ==<br />
Jailbreaks known to enable hgsp4 include:<br />
* [[Pangu9]] (9.1) on 64-bit<br />
* [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu+mach_portal]] (10.0-10.1.1) on 64-bit<br />
* [[h3lix]] (10.0–10.3.3) on 32-bit<br />
* [[Electra]] (11.0-11.1.2) on 64-bit<br />
<br />
== See also ==<br />
* [[tfp0 patch]]<br />
<br />
== References ==<br />
<references /><br />
<br />
[[Category:Kernel Patches]]</div>Bellis1000https://www.theiphonewiki.com/w/index.php?title=Hgsp4_patch&diff=68489Hgsp4 patch2018-03-31T18:47:42Z<p>Bellis1000: /* hgsp4 enabled jailbreaks */</p>
<hr />
<div>{{DISPLAYTITLE:hgsp4 patch}}<br />
A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel task by calling '''host_get_special_port''' for host special port '''4''' (hence the name). This host special port is usually unused, and the kernel task port must be “mounted” there by an exploit.<ref>https://bazad.github.io/2017/09/live-kernel-introspection-ios/</ref><ref>https://github.com/iabem97/hermes/blob/master/hermes/disable_protections.c</ref> It is thus recommended that host special port 4 be used solely for the kernel task port.<ref>http://www.newosxbook.com/forum/viewtopic.php?f=8&t=16641</ref> <br />
<br />
The hgsp4 route is equivalent to the [[tfp0]] route, and tools that rely on tfp0 can be recompiled to use hgsp4 instead.<ref>[https://twitter.com/panguteam/status/708330906084216833 @PanguTeam: For security researchers, calling host_get_special_port with 4 on jailbroken devices will give u kernel task port just like task_for_pid(0)]</ref> In a tweet, tihmstar confirmed that this applies to [[kloader]] too.<ref>[https://twitter.com/tihmstar/status/945613035489644544 @tihmstar: kloader works fine with h3lix :) Thanks to @nyan_satan for sending me a compiled version which uses hgsp(4)]</ref><br />
<br />
== Example code ==<br />
The following example C program calls <code>host_get_special_port</code> and, on success, returns a positive integer that can be checked using <code>echo $?</code> in bash after running the test program:<br />
<br />
#include <mach/mach.h><br />
<br />
int main(void) {<br />
mach_port_t kernel_task = 0;<br />
if (!host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &kernel_task)) return -1;<br />
return kernel_task;<br />
}<br />
<br />
-1 is returned on error. 0 is returned if no hgsp4 patch is enabled.<br />
<br />
== hgsp4 enabled jailbreaks ==<br />
Jailbreaks known to enable hgsp4 include:<br />
* [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu+mach_portal]] (10.0-10.1.1) on 64-bit<br />
* [[h3lix]] (10.0–10.3.3) on 32-bit<br />
* [[Electra]] (11.0-11.1.2) on 64-bit<br />
<br />
== See also ==<br />
* [[tfp0 patch]]<br />
<br />
== References ==<br />
<references /><br />
<br />
[[Category:Kernel Patches]]</div>Bellis1000https://www.theiphonewiki.com/w/index.php?title=Hgsp4_patch&diff=68488Hgsp4 patch2018-03-31T18:47:28Z<p>Bellis1000: /* hgsp4 enabled jailbreaks */</p>
<hr />
<div>{{DISPLAYTITLE:hgsp4 patch}}<br />
A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel task by calling '''host_get_special_port''' for host special port '''4''' (hence the name). This host special port is usually unused, and the kernel task port must be “mounted” there by an exploit.<ref>https://bazad.github.io/2017/09/live-kernel-introspection-ios/</ref><ref>https://github.com/iabem97/hermes/blob/master/hermes/disable_protections.c</ref> It is thus recommended that host special port 4 be used solely for the kernel task port.<ref>http://www.newosxbook.com/forum/viewtopic.php?f=8&t=16641</ref> <br />
<br />
The hgsp4 route is equivalent to the [[tfp0]] route, and tools that rely on tfp0 can be recompiled to use hgsp4 instead.<ref>[https://twitter.com/panguteam/status/708330906084216833 @PanguTeam: For security researchers, calling host_get_special_port with 4 on jailbroken devices will give u kernel task port just like task_for_pid(0)]</ref> In a tweet, tihmstar confirmed that this applies to [[kloader]] too.<ref>[https://twitter.com/tihmstar/status/945613035489644544 @tihmstar: kloader works fine with h3lix :) Thanks to @nyan_satan for sending me a compiled version which uses hgsp(4)]</ref><br />
<br />
== Example code ==<br />
The following example C program calls <code>host_get_special_port</code> and, on success, returns a positive integer that can be checked using <code>echo $?</code> in bash after running the test program:<br />
<br />
#include <mach/mach.h><br />
<br />
int main(void) {<br />
mach_port_t kernel_task = 0;<br />
if (!host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &kernel_task)) return -1;<br />
return kernel_task;<br />
}<br />
<br />
-1 is returned on error. 0 is returned if no hgsp4 patch is enabled.<br />
<br />
== hgsp4 enabled jailbreaks ==<br />
Jailbreaks known to enable hgsp4 include:<br />
* [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu+mach_portal]] (10.0-10.1.1) on 64-bit<br />
* [[h3lix]] (10.0–10.3.3) on 32-bit<br />
* [[Electra]] (11.0 - 11.1.2) on 64-bit<br />
<br />
== See also ==<br />
* [[tfp0 patch]]<br />
<br />
== References ==<br />
<references /><br />
<br />
[[Category:Kernel Patches]]</div>Bellis1000