{"id":21884068,"url":"https://github.com/leiless/kern_base","last_synced_at":"2025-08-25T21:04:56.533Z","repository":{"id":140255103,"uuid":"183718594","full_name":"leiless/kern_base","owner":"leiless","description":"Fetch Darwin kernel __HIB \u0026 slide address","archived":false,"fork":false,"pushed_at":"2020-11-05T12:33:12.000Z","size":13,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-08-23T22:09:41.675Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/leiless.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-04-27T02:25:44.000Z","updated_at":"2022-02-10T21:10:39.000Z","dependencies_parsed_at":null,"dependency_job_id":"0c807d55-e635-4ec9-be73-4f5ca68d5abe","html_url":"https://github.com/leiless/kern_base","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/leiless/kern_base","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fkern_base","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fkern_base/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fkern_base/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fkern_base/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/leiless","download_url":"https://codeload.github.com/leiless/kern_base/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fkern_base/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":272131793,"owners_count":24878986,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-25T02:00:12.092Z","response_time":1107,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-28T10:12:08.290Z","updated_at":"2025-08-25T21:04:56.500Z","avatar_url":"https://github.com/leiless.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"## kern_base - Fetch Darwin kernel `__HIB`/text base\n\n`kern_base` is a macOS kernel extension used to fetch Darwin `__HIB` text base and kernel text base\n\n### Rationale\n\nThis project mainly inspired by [aidensstuff/kbase](https://github.com/aidensstuff/kbase), yet it currently undocumented. it uses a relative intuitive way to resolve kernel text bases(KALSR):\n\n1. Masking `0xfffffffffff00000` with a kernel symbol address and threat it as a `struct mach_header_64 *`.\n\n2. Check its first 4 bytes if equals to `MH_MAGIC_64`, if it equals, we're done.\n\n3. Otherwise, we subtract the kernel symbol address by `0x100000` and goto step 1.\n\n### Test\n\n```shell\nmake [release]\n\nsudo rm -rf /tmp/kern_base.kext\nsudo cp -r kern_base.kext /tmp\nsudo kextload -v 6 /tmp/kern_base.kext\n```\n\nAfter kext loaded, you can use [sysctl(8)](x-man-page://8/sysctl) to check the result:\n\n```shell\nsysctl kern.addr\nkern.addr._hib: 0xffffff8011900000\nkern.addr.kern: 0xffffff8011a00000\n\n# Above is a sample output\n```\n\nTo unload the kext after you tested:\n\n```shell\nsudo kextunload -v 6 /tmp/kern_base.kext\n```\n\n### Limitation\n\n* Currently this kext only suitable for non-fat 64-bit Mach-O kernels, it won't be a big issue since modern Darwin kernels is flat 64-bit Mach-O format.\n\n* Only tested on a limited set of kernels, assumably support macOS from 10.8 to 10.14(both inclusive):\n\n\t10.14.4(18E226)\n\n\t10.13.6(10.13.6)\n\n\t--10.12.6--\n\n\t10.11.6(15G31)\n\n\t10.10.5(14F27)\n\n\t10.9.5(13F1911)\n\n* Iterative checking first 4 bytes isn't safe since an address mayn't got paged, thusly triggers a page fault and kernel panicked!\n\n### *References*\n\n[aidensstuff/kbase](https://github.com/aidensstuff/kbase)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleiless%2Fkern_base","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fleiless%2Fkern_base","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleiless%2Fkern_base/lists"}