CODEWITHSUNDEEP
kernelosx-mountain-lionmachxnu
iookl
iookl

Reputation: 51

Mach vm_read not returning the expected values for OSX 10.8.2

I just recently moved to the UNIX platform and currently doing research on operating systems. Right now, I am particularly interested at the design/implementation of XNU and currently on the topic of processes and memory.

I have this code snippet which allows my executable to obtain a task port from another process

int retValTask = task_for_pid(mach_task_self(), pid, &task);
if (retValTask != KERN_SUCCESS || !MACH_PORT_VALID(task)) {
    printf("Error while getting port, check if root or valid pid");
}
...
int retValVmRead = mach_vm_read(task, (vm_address_t)0x100000000, sizeof(uint32_t), (vm_offset_t *)&magic, &sz);

I am aware the Mac OSX 10.8.2 has ASLR, so the target process that I run is invoked via gdb.

(gdb) start
Breakpoint 1 at 0x100000ed8
Starting program: /private/tmp/test 
Reading symbols for shared libraries +............................. done

Breakpoint 1, 0x0000000100000ed8 in main ()

I can also verify inside GDB that the address 0x100000000 contains Mach-O's magic number.

(gdb) x/x 0x100000000
0x100000000 <_mh_execute_header>:   0xfeedfacf
(gdb)

However, when my program tries to read the memory of the target process, it just returns random values, not the magic number that I am expecting (it's random).

 2157 -> 1103 [0 - (os/kern) successful]
 0x0619F000

2157 is the target PID, 1103 is the task port along with the result from mach_error_string. Also I tried the vm_read function and still the same behavior.

Upvotes: 3

Views: 1182

Answers (1)

iookl
iookl

Reputation: 51

Nvm, found the problem. The magic variable should be treated as a pointer and not the actual memory cell where the data is copied.

pointer_t magic;
...
int magicValue = (uint32_t) *((int *)(magic));

Upvotes: 2

Related Questions