Hgsp4 patch - Revision history

Bellis1000: /* hgsp4 enabled jailbreaks */

2018-03-31T19:11:27Z

‎hgsp4 enabled jailbreaks

Bellis1000: /* hgsp4 enabled jailbreaks */

2018-03-31T18:47:42Z

‎hgsp4 enabled jailbreaks

Bellis1000: /* hgsp4 enabled jailbreaks */

2018-03-31T18:47:28Z

‎hgsp4 enabled jailbreaks

Gjest: Created page with "{{DISPLAYTITLE:hgsp4 patch}} A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel t..."

2017-12-26T21:21:20Z

Created page with "{{DISPLAYTITLE:hgsp4 patch}} A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel t..."

New page

{{DISPLAYTITLE:hgsp4 patch}}
A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel task by calling '''host_get_special_port''' for host special port '''4''' (hence the name). This host special port is usually unused, and the kernel task port must be “mounted” there by an exploit.<ref>https://bazad.github.io/2017/09/live-kernel-introspection-ios/</ref><ref>https://github.com/iabem97/hermes/blob/master/hermes/disable_protections.c</ref> It is thus recommended that host special port 4 be used solely for the kernel task port.<ref>http://www.newosxbook.com/forum/viewtopic.php?f=8&t=16641</ref>

The hgsp4 route is equivalent to the [[tfp0]] route, and tools that rely on tfp0 can be recompiled to use hgsp4 instead.<ref>[https://twitter.com/panguteam/status/708330906084216833 @PanguTeam: For security researchers, calling host_get_special_port with 4 on jailbroken devices will give u kernel task port just like task_for_pid(0)]</ref> In a tweet, tihmstar confirmed that this applies to [[kloader]] too.<ref>[https://twitter.com/tihmstar/status/945613035489644544 @tihmstar: kloader works fine with h3lix :) Thanks to @nyan_satan for sending me a compiled version which uses hgsp(4)]</ref>

== Example code ==
The following example C program calls <code>host_get_special_port</code> and, on success, returns a positive integer that can be checked using <code>echo $?</code> in bash after running the test program:

#include <mach/mach.h>

int main(void) {
mach_port_t kernel_task = 0;
if (!host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &kernel_task)) return -1;
return kernel_task;
}

-1 is returned on error. 0 is returned if no hgsp4 patch is enabled.

== hgsp4 enabled jailbreaks ==
Jailbreaks known to enable hgsp4 include:
* [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu+mach_portal]] (10.0-10.1.1) on 64-bit
* [[h3lix]] (10.0–10.3.3) on 32-bit

== See also ==
* [[tfp0 patch]]

== References ==
<references />

[[Category:Kernel Patches]]

@@ Line 19: / Line 19: @@
 == hgsp4 enabled jailbreaks ==
 Jailbreaks known to enable hgsp4 include:
 * [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu+mach_portal]] (10.0-10.1.1) on 64-bit
 * [[h3lix]] (10.0–10.3.3) on 32-bit

@@ Line 21: / Line 21: @@
 * [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu+mach_portal]] (10.0-10.1.1) on 64-bit
 * [[h3lix]] (10.0–10.3.3) on 32-bit
-* [[Electra]] (11.0 - 11.1.2) on 64-bit
+* [[Electra]] (11.0-11.1.2) on 64-bit
 == See also ==