bazad/memctl-kext-core

A memctl core for macOS that uses a kernel extension.

memctl-kext-core's Issues

[kext] Add dynamic symbols resolution

Hey @bazad, first of all, congrats for the great tool! It's awesome!
I only have one suggestion, and wanted to talk with you about it:

I usually do macOS research with VMs: because I don't want to panic my host when I try stuff that could go wrong (like accidentally accessing unmapped memory, etc.) and also because I can't load kexts when SIP is enabled.

Those VMs have different macOS versions (10.12.6 and 10.13.2 for example).
Instead my host, it's always at the latest version.

The current design of the KernelTask.kext, is that it hardcodes the symbols's offsets with the ones of the OS's kernel (/System/Library/Kernels/kernel) used to compile the kext.

In this way, it's hard to cross compile the kext from the host to the VMs.

Now, @Siguza wrote a similar kext (hsp4) to access the kernel_task from user-space: his kext uses dynamic symbol resolution so that the symbols are resolved at runtime and not hardcoded. Also remaps the kernel_task (instead of copying it) so that you can access the real one.

I think that would be nice to integrate the dynamic symbol resolution in this kext, or better, to use hsp4 as the kext (git submodule?), and modify the core accordingly (or maybe, after adding x86_64 support, memctl-tfp0-core could replace the memctl-kext-core).

Let me know what you think!

Thanks