prosper0gdb: bugfixes & new offsets

prosper0gdb/Makefile

@@ -7,7 +7,7 @@ clean:
 	cd ../lib; make
 
 r0run.o: r0run.asm
-	yasm -f elf64 r0run.asm
+	yasm -f elf64 -g dwarf2 r0run.asm -o r0run.o
 
 prosper0gdb.o: r0gdb.c r0run.o
 	gcc -O0 -g -isystem ../freebsd-headers -nostdinc -nostdlib -fno-stack-protector -Wl,-r,--unique='*' -ffunction-sections -fdata-sections r0gdb.c r0run.o -o prosper0gdb.o -fPIE -ffreestanding

prosper0gdb/main.c

@@ -121,6 +121,23 @@ int remount_rw(const char* dev, const char* mnt)
     return do_nmount(iov, 14, MNT_UPDATE);
 }
 
+void log_deltas(uint64_t pointer)
+{
+    for(;;)
+    {
+        struct regs regs = {0};
+        regs.rip = pointer;
+        regs.eflags = 0x102;
+        run_in_kernel(&regs);
+        uint32_t delta = regs.rip - (pointer + 5);
+        char buf[9] = {[8] = '\n'};
+        for(int i = 0; i < 8; i++)
+            buf[i] = "0123456789abcdef"[(delta >> (28-4*i))&15];
+        gdb_remote_syscall("write", 3, 0, (uintptr_t)1, (uintptr_t)buf, (uintptr_t)9);
+        pointer += 8;
+    }
+}
+
 int main(void* ds, int a, int b, uintptr_t c, uintptr_t d)
 {
     r0gdb_init(ds, a, b, c, d);

prosper0gdb/r0gdb.c

@@ -367,21 +367,26 @@ uint64_t r0gdb_read_dbreg(int which)
     return regs[which];
 }
 
-void r0gdb_write_dbregs(uint64_t* out)
+void r0gdb_write_dbregs(uint64_t* inp)
 {
     struct regs regs = {0};
     regs.rip = kdata_base - 0x9d6c7a;
     regs.rsp = kstack;
     regs.eflags = 0x102;
-    regs.r15 = out[0];
-    regs.r14 = out[1];
-    regs.r13 = out[2];
-    regs.rbx = out[3];
-    regs.r11 = out[4];
-    regs.rcx = out[5];
-    regs.rax = r0gdb_read_dbreg(7);
+    regs.r15 = inp[0];
+    regs.r14 = inp[1];
+    regs.r13 = inp[2];
+    regs.rbx = inp[3];
+    regs.r11 = inp[4];
+    regs.rcx = inp[5];
+    regs.rax = inp[5];
     for(int i = 0; i < 9; i++)
         run_in_kernel(&regs);
+    regs.r11 = inp[4];
+    regs.r15 = inp[5];
+    regs.rip = kdata_base - 0x9d6b87;
+    for(int i = 0; i < 3; i++)
+        run_in_kernel(&regs);
 }
 
 void r0gdb_write_dbreg(int which, uint64_t value)
@@ -843,6 +848,11 @@ static int instrs_left;
 static void instr_count(uint64_t* regs)
 {
     SKIP_SCHEDULER
+    if(!(regs[2] & 256))
+    {
+        regs[2] |= 256;
+        instrs_left = 100;
+    }
     if(regs[0] == instr_start)
     {
         regs[0] = instr_jump;
@@ -1056,9 +1066,19 @@ static void do_dump_at_rip(uint64_t* regs)
                 reg = regs[*prg++];
             while(*prg != (uint64_t)-1)
             {
-                uint64_t val;
-                kmemcpy(&val, (void*)(reg + (*prg++)), 8);
-                reg = val;
+                if(*prg == (uint64_t)-2)
+                {
+                    prg++;
+                    if(*prg == (uint64_t)-2)
+                        break;
+                    reg += *prg++;
+                }
+                else
+                {
+                    uint64_t val;
+                    kmemcpy(&val, (void*)(reg + (*prg++)), 8);
+                    reg = val;
+                }
             }
             prg++;
             *(uint64_t*)(*prg++) = reg;

prosper0gdb/r0run.asm

@@ -124,6 +124,7 @@ mov rdi, [rel trace_start]
 mov rsi, rsp
 rep movsb
 mov [rel trace_start], rdi
+or byte [rsp+18], 1
 cmp qword [rel trace_prog], 0
 jz .no_program
 mov rdi, rsp

prosper0gdb/stuff/offsets.txt

@@ -53,3 +53,6 @@ p/x $authmgr_loadSelfSegment_call_mailbox = kdata_base - 0x8a5546
 
 p/x $authmgr_decryptSelfBlock = kdata_base - 0x8a5410
 p/x $authmgr_decryptSelfBlock_call_mailbox = kdata_base - 0x8a5019
+
+p/x $verifySuperBlock_call_mailbox = kdata_base - 0x94a7f5
+p/x $unloadPfsmgrSecureModule_call_mailbox = kdata_base - 0x229b7b