serjepatoff / hydra Goto Github PK

                                                                       
 ____   ____  _____      _____      _____        _____          ____   
|    | |    ||\    \    /    /| ___|\    \   ___|\    \    ____|\   \  
|    | |    || \    \  /    / ||    |\    \ |    |\    \  /    /\    \ 
|    |_|    ||  \____\/    /  /|    | |    ||    | |    ||    |  |    |
|    .-.    | \ |    /    /  / |    | |    ||    |/____/ |    |__|    |
|    | |    |  \|___/    /  /  |    | |    ||    |\    \ |    .--.    |
|    | |    |      /    /  /   |    | |    ||    | |    ||    |  |    |
|____| |____|     /____/  /    |____|/____/||____| |____||____|  |____|
|    | |    |    |`    | /     |    /    | ||    | |    ||    |  |    |
|____| |____|    |_____|/      |____|____|/ |____| |____||____|  |____|
  \(     )/         )/           \(    )/     \(     )/    \(      )/  
   '     '          '             '    '       '     '      '      '   
Hydra

Copyright (c) fG!, 2012,2013 - [email protected] - http://reverse.put.as
All rights reserved.

Welcome,

Hydra is sample code of a kernel extension that will intercept process creation, suspend, and 
communicate it to a userland daemon that will be in charge of patching the application.

Its goal is to demonstrate a process hijacking technique from the kernel and also how to use
kernel control API. Technically all the patching could be done from the kernel extension.

It can be used to crack codesign applications without touching the disk image or resigning
the code. This is due to the fact that patching is done after code signature is verified.
The only exception is if there are any code checksum features, either using internal functions
or the ones from Apple code signing (not even sure if there's an API available for this).

The kernel extension should be feature complete but the userland daemon implements a very
basic example of adding a target and patching it. To be complete it needs an interface to
add targets at request, save a configuration file with targets and patching information.

The userland daemon requires task_for_pid() privileges. You will need to run it as root
or sign it to run with debugging privileges (as gdb does). Follow this lldb document
https://llvm.org/svn/llvm-project/lldb/trunk/docs/code-signing.txt to sign it.

The only supported target for now is Mountain Lion. It's rather easy to support all OS X
versions. In fact if the target is Lion and/or Mountain Lion, there's no need to read
the kernel image from disk to solve symbols. They are available in memory! This applies
if you want to make it work with Snow Leopard and below. Anyway, this code is also an 
example about how to read/write files from a kernel extension.

As usual, this is only sample code. Any usage you make out of it is your own responsibility.

Have fun,
fG!