From fc6fbed67c26e29db9ec5d7a62df3f06ad2b7bb3 Mon Sep 17 00:00:00 2001 From: vit9696 Date: Sat, 23 Mar 2019 15:04:56 +0300 Subject: [PATCH] Fix symbol retrieval logic in injected kext, still needs dysymtab correction --- Library/OcAppleKernelLib/PrelinkedInternal.h | 9 +++++++++ Library/OcAppleKernelLib/PrelinkedKext.c | 4 ++++ 2 files changed, 13 insertions(+) diff --git a/Library/OcAppleKernelLib/PrelinkedInternal.h b/Library/OcAppleKernelLib/PrelinkedInternal.h index d44ba3b9..a4bf4d83 100644 --- a/Library/OcAppleKernelLib/PrelinkedInternal.h +++ b/Library/OcAppleKernelLib/PrelinkedInternal.h @@ -105,8 +105,17 @@ struct PRELINKED_KEXT_ { // Sorted symbol table used only for dependencies. // PRELINKED_KEXT_SYMBOL *LinkedSymbolTable; + // + // A flag set during dependency walk BFS to avoid going through the same path. + // BOOLEAN Processed; + // + // Number of vtables in this kext. + // UINT32 NumberOfVtables; + // + // Scanned vtable buffer. Iterated with GET_NEXT_PRELINKED_VTABLE. + // PRELINKED_VTABLE *LinkedVtables; }; diff --git a/Library/OcAppleKernelLib/PrelinkedKext.c b/Library/OcAppleKernelLib/PrelinkedKext.c index d9087c13..19721c1d 100644 --- a/Library/OcAppleKernelLib/PrelinkedKext.c +++ b/Library/OcAppleKernelLib/PrelinkedKext.c @@ -764,5 +764,9 @@ InternalLinkPrelinkedKext ( *AlignedLoadSize = RealLoadSize; + Kext->SymbolTable = NULL; + Kext->StringTable = NULL; + Kext->NumberOfSymbols = 0; + return Kext; }