Breaking iOS Code Signing - Reverse Engineering Mac OS X

Patch 2uintptr_t ImageLoaderMachO::reserveAnAddressRange(size_t length, constImageLoader::LinkContext& context){vm_address_t addr = 0;vm_size_t size = length;if ( fgNextPIEDylibAddress != 0 ) {// add small (0-3 pages) random padding between dylibsaddr = fgNextPIEDylibAddress + (__stack_chk_guard/fgNextPIEDylibAddress &(sizeof(long)-1))*4096;kern_return_t r = vm_allocate(mach_task_self(), &addr, size, VM_FLAGS_FIXED);if ( r == KERN_SUCCESS ) {fgNextPIEDylibAddress = addr + size;return addr;}fgNextPIEDylibAddress = 0;}kern_return_t r = vm_allocate(mach_task_self(), &addr, size, VM_FLAGS_ANYWHERE);if ( r != KERN_SUCCESS )throw "out of address space";}return addr;Friday, October 14, 11