Kernel Syscalls - Revision history

Stek29: arm64

2018-02-02T21:48:48Z

arm64

Stek29: some arm64 stuff

2018-02-02T21:47:46Z

some arm64 stuff

Morpheus: /* List of system calls from iOS 6.0 GM , link to joker tool */

2012-09-25T18:37:13Z

‎List of system calls from iOS 6.0 GM , link to joker tool

Morpheus: /* List of system calls from iOS 6.0GM */

2012-09-25T01:39:37Z

‎List of system calls from iOS 6.0GM

Morpheus: /* List of system calls from iOS 6.0b3 */

2012-09-25T01:38:38Z

‎List of system calls from iOS 6.0b3

Morpheus: /* List of system calls from iOS 6.0 GM/final */

2012-09-25T01:37:59Z

‎List of system calls from iOS 6.0 GM/final

Morpheus: /* List of system calls from iOS 6.0 GM/final */

2012-09-25T01:37:23Z

‎List of system calls from iOS 6.0 GM/final

Show changes

5urd at 23:59, 2 September 2012

2012-09-02T23:59:23Z

5urd: /* List of system calls from iOS 6.0b3 */

2012-09-02T23:58:41Z

‎List of system calls from iOS 6.0b3

Morpheus: /* List of system calls from iOS 6.0b3 */

2012-08-31T01:02:34Z

‎List of system calls from iOS 6.0b3

@@ Line 1: / Line 1: @@
 == Note on these ==
-Args go in their normal registers, like arg1 in R0, as usual. Syscall # goes in IP (that's intra-procedural, not instruction pointer!), a.k.a R12.
+Args go in their normal registers, like arg1 in R0/X0, as usual. Syscall # goes in IP (that's intra-procedural, not instruction pointer!), a.k.a R12/X16.
 As in all ARM (i.e. also on Android) the kernel entry is accomplished by the SVC command (SWI in some debuggers and ARM dialects). On the kernel end, a low level CPU exception handler (fleh_swi) is installed as part of the ExceptionVectorsBase, and - upon issuing a SWI/SVC - control is transferred to that address. This handler can check the syscall number to distinguish between POSIX calls (non negative) and Mach traps (negative).

@@ Line 7: / Line 7: @@
 === Usage ===
 <pre>
-MOV IP, #x // number from following list into Intraprocedural, a.k.a. r12
+MOV IP, #x // number from following list into Intraprocedural, a.k.a. r12 on arm32 and x16 on arm64
 SVC 0x80   // Formerly, SWI (software interrupt)
 </pre>
-For example:
+For example, arm32:
 <pre>
@@ Line 17: / Line 17: @@
 x30d2ad54 <chown>:	mov	r12, #16	       ; 0x10, being # of chown
 x30d2ad58 <chown+4>:	svc	0x00000080
 </pre>
 Most of these are the same as you would find in the XNU open source kernel, with ARM idiosyncrasies aside (and #372, ledger)
 === sysent ===

@@ Line 47: / Line 47: @@
 '''note: Even though a syscall is present in the table, it does not in any way imply it is functional. Auditing, for example, is not enabled in iOS (no CONFIG_AUDIT in the XNU build). Most of these syscalls are the same as those of OS X, with the exception of ledger (which actually makes a comeback in OS X Mountain Lion), and 434+ (CONFIG_EMBEDDED).
-A good reference on these can be found at [http://newosxbook.com/index.php?page=Appendix ''Wiley's OS X and iOS Internals'' online appendix].
+A good reference on these can be found at [http://newosxbook.com/index.php?page=Appendix ''Wiley's OS X and iOS Internals'' online appendix]. The joker tool (shown below) can be downloaded from the same site.
 <pre>
 This is an ARM binary. Applying iOS kernel signatures
 Syscall names are @2a70f0
 Sysent offset in file/memory (for patching purposes): 0x2ef0c0/0x802f00c0
 Suppressing enosys (0x800b3429)  T = Thumb
@@ Line 274: / Line 273: @@
 . lio_listio           801c6564 T
 . iopolicysys          801de420 T
-. 323                  8021a72c T
+. process_policy       8021a72c T
 . mlockall             801d88b4 T
 . munlockall           801d88b8 T

@@ Line 43: / Line 43: @@
 Because system calls arguments are set in stone, it is straightforward to write code to find the signature of the first few syscalls (syscall, exit, fork..), and from there calculate the other sysent entries. A program to do so reliable on iOS has, in fact, been written, and produces the following output for iOS 6.0b1:
-=== List of system calls from [[iOS]] 6.0b3 ===
+=== List of system calls from [[iOS]] 6.0 GM ===
 '''note: Even though a syscall is present in the table, it does not in any way imply it is functional. Auditing, for example, is not enabled in iOS (no CONFIG_AUDIT in the XNU build). Most of these syscalls are the same as those of OS X, with the exception of ledger (which actually makes a comeback in OS X Mountain Lion), and 434+ (CONFIG_EMBEDDED).
@@ Line 54: / Line 54: @@
 This is an ARM binary. Applying iOS kernel signatures
 Syscall names are @2a70f0
-Sysent offset in file/memory (for patching purposes):</pre> '''0x2ef0c0/0x802f00c0'''<pre>
+Sysent offset in file/memory (for patching purposes): 0x2ef0c0/0x802f00c0
 ..This appears to be XNU 2107.2.33
-Suppressing enosys (0x800b3429)   T = Thumb
+Suppressing enosys (0x800b3429)  T = Thumb
-. exit                 801d4a74 T
+. exit                  801d4a74 T
-. fork                 801d7980 T
+. fork                  801d7980 T
-. read                 801eb584 T
+. read                  801eb584 T
-. write                801eb958 T
+. write                 801eb958 T
-. open                 800b13a4 T
+. open                  800b13a4 T
-. close                801ccab4 T
+. close                 801ccab4 T
-. wait4                801d56bc T
+. wait4                 801d56bc T
-. link                 800b18e8 T
+. link                  800b18e8 T
 . unlink               800b1ff0 T
 . chdir                800b0c60 T

@@ Line 54: / Line 54: @@
 This is an ARM binary. Applying iOS kernel signatures
 Syscall names are @2a70f0
-Sysent offset in file/memory (for patching purposes):  <b>0x2ef0c0/0x802f00c0</b>
+Sysent offset in file/memory (for patching purposes):</pre> '''0x2ef0c0/0x802f00c0'''<pre>
 ..This appears to be XNU 2107.2.33

@@ Line 3: / Line 3: @@
 As in all ARM (i.e. also on Android) the kernel entry is accomplished by the SVC command (SWI in some debuggers and ARM dialects). On the kernel end, a low level CPU exception handler (fleh_swi) is installed as part of the ExceptionVectorsBase, and - upon issuing a SWI/SVC - control is transferred to that address. This handler can check the syscall number to distinguish between POSIX calls (non negative) and Mach traps (negative).
 == Unix ==
 === Usage ===
 <pre>
@@ Line 25: / Line 22: @@
 === sysent ===
 The system call table in XNU is known as "sysent", and is no longer a public symbol, for obvious reasons (e.g. syscall hooking). It is fairly straightforward, however, to find the sysent and its calls. While i0nic proposes a heuristic of finding the sysent based on the exported kdebug symbol, this is unreliable, as the symbol is no longer exported. A better way is to home in on the pattern of the struct sysent entries itself, i.e - as defined in bsd/sys/sysent.h:
@@ Line 466: / Line 461: @@
 </pre>

@@ Line 381: / Line 381: @@
 . pid_shutdown_sockets 8021c158 T
 . shared_region_map_and_slide_np 8021c7ec T
-. kas_info             8021c9e8 T   ; Provides ASLR information to user space (intentionally crippled in iOS, works in ML)
+. kas_info             8021c9e8 T   ; Provides ASLR information to user space
 . memorystatus_control 801e60f0 T   ; Controls memory status  (JetSam)
 . guarded_open_np      801ce9cc T   ; New in 6b3, maybe b2