specter-mem 1.0.5

ARM64 memory manipulation framework for iOS/macOS — inline hooking, stealth code patching, hardware breakpoints, and shellcode loading
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

//! Mach Exception Port FFI Bindings
//!
//! This module provides FFI bindings for Mach exception handling functions
//! that are not available in existing crates like mach2 or libc.

use mach2::port::mach_port_t;
use mach2::vm_types::{mach_vm_address_t, mach_vm_size_t};
use std::ffi::c_void;

/// Type alias for kernel return code
pub type KernReturnT = i32;
/// Mask for exception types
pub type ExceptionMaskT = u32;
/// Behavior for exception handling
pub type ExceptionBehaviorT = i32;
/// Flavor for thread state
pub type ThreadStateFlavor = i32;

unsafe extern "C" {
    /// Sets exception ports for a task
    ///
    /// # Arguments
    /// * `task` - The task port (usually `mach_task_self()`)
    /// * `exception_mask` - Mask of exceptions to catch (e.g., `EXC_MASK_BREAKPOINT`)
    /// * `new_port` - The port to send exception messages to
    /// * `behavior` - The behavior of the exception (e.g., `EXCEPTION_DEFAULT`)
    /// * `new_flavor` - The state flavor (e.g., `ARM_THREAD_STATE64`)
    ///
    /// # Returns
    /// * `KernReturnT` - `KERN_SUCCESS` on success
    pub fn task_set_exception_ports(
        task: mach_port_t,
        exception_mask: ExceptionMaskT,
        new_port: mach_port_t,
        behavior: ExceptionBehaviorT,
        new_flavor: ThreadStateFlavor,
    ) -> KernReturnT;

    /// Gets existing exception ports for a task
    ///
    /// # Arguments
    /// * `task` - The task port
    /// * `exception_mask` - Mask of exceptions to query
    /// * `masks` - Output array for masks
    /// * `masks_cnt` - Output count of masks
    /// * `old_handlers` - Output array for existing handler ports
    /// * `old_behaviors` - Output array for existing behaviors
    /// * `old_flavors` - Output array for existing flavors
    ///
    /// # Returns
    /// * `KernReturnT` - `KERN_SUCCESS` on success
    pub fn task_get_exception_ports(
        task: mach_port_t,
        exception_mask: ExceptionMaskT,
        masks: *mut ExceptionMaskT,
        masks_cnt: *mut u32,
        old_handlers: *mut mach_port_t,
        old_behaviors: *mut ExceptionBehaviorT,
        old_flavors: *mut ThreadStateFlavor,
    ) -> KernReturnT;

    /// Sets the execution state of a task/thread
    ///
    /// # Arguments
    /// * `task` - The task or thread port
    /// * `flavor` - The state flavor (e.g., `ARM_DEBUG_STATE64`)
    /// * `state` - Pointer to the state structure
    /// * `count` - Size of the state structure in 32-bit words
    ///
    /// # Returns
    /// * `KernReturnT` - `KERN_SUCCESS` on success
    pub fn task_set_state(
        task: mach_port_t,
        flavor: ThreadStateFlavor,
        state: *const c_void,
        count: u32,
    ) -> KernReturnT;

    /// Remaps a memory region
    ///
    /// # Arguments
    /// * `target_task` - The task port to remap to
    /// * `target_address` - The address to remap to
    /// * `size` - The size of the region to remap
    /// * `mask` - The mask of the region to remap
    /// * `flags` - The flags of the region to remap
    /// * `src_task` - The task port to remap from
    /// * `src_address` - The address to remap from
    /// * `copy` - Whether to copy the region
    /// * `cur_protection` - The current protection of the region
    /// * `max_protection` - The maximum protection of the region
    /// * `inheritance` - The inheritance of the region
    ///
    /// # Returns
    /// * `KernReturnT` - `KERN_SUCCESS` on success
    pub fn mach_vm_remap(
        target_task: mach_port_t,
        target_address: *mut mach_vm_address_t,
        size: mach_vm_size_t,
        mask: u64,
        flags: i32,
        src_task: mach_port_t,
        src_address: mach_vm_address_t,
        copy: i32,
        cur_protection: *mut i32,
        max_protection: *mut i32,
        inheritance: u32,
    ) -> i32;
}