{"id":21884074,"url":"https://github.com/leiless/ksymresolver","last_synced_at":"2025-04-15T07:18:38.415Z","repository":{"id":140255117,"uuid":"152839317","full_name":"leiless/ksymresolver","owner":"leiless","description":"XNU kernel symbol resolver(kernel extension)","archived":false,"fork":false,"pushed_at":"2019-03-01T14:07:57.000Z","size":41,"stargazers_count":12,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-15T07:18:34.009Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/leiless.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-10-13T05:41:33.000Z","updated_at":"2024-07-04T13:16:10.000Z","dependencies_parsed_at":null,"dependency_job_id":"32f44c73-21ba-472f-a00a-5f0b48f7ed32","html_url":"https://github.com/leiless/ksymresolver","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fksymresolver","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fksymresolver/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fksymresolver/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leiless%2Fksymresolver/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/leiless","download_url":"https://codeload.github.com/leiless/ksymresolver/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249023745,"owners_count":21199961,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-28T10:12:08.668Z","updated_at":"2025-04-15T07:18:38.407Z","avatar_url":"https://github.com/leiless.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"### *ksymresolver* - XNU kernel symbol resolver(kernel extension)\n\nA generic kernel extension used to resolve not-exported kernel symbols, primary target on macOS \u003e= 10.11\n\nAlso it can be used as a sole kext dependency for resolving dependencies.\n\n---\n\n#### Prototype\n\n```c\n/**\n * Resolve a kernel symbol address\n * @param name          symbol name(should begin with _)\n * @return              NULL if not found\n */\nvoid * __nullable resolve_ksymbol(const char * __nonnull name);\n```\n\nTips: you should resolve all kernel symbols you need at kext load stage, and fail load if any symbol cannot be resolved.\n\n#### Compile\n\n```shell\n# Use `release' target for a release build\n$ make\n$ make -C test\n```\n\n#### Load \u0026 test\n\n```\n$ sudo cp -r ksymresolver.kext /tmp\n$ sudo cp -r test/ksymresolver_test.kext /tmp\n\n$ sudo kextload -v /tmp/ksymresolver.kext\n\n# Actually you don't have to load ksymresolver.kext first  since dependencies will load it automatically\n$ sudo kextload -v -r . /tmp/ksymresolver_test.kext\nPassword:\nRequesting load of /private/tmp/ksymresolver_test.kext.\n/private/tmp/ksymresolver_test.kext loaded successfully (or already loaded).\n```\n\n#### Sample output\n\nTested on [10.11, 10.14(18D109)]\n\n```\n$ sw_vers\nProductName:\tMac OS X\nProductVersion:\t10.14.2\nBuildVersion:\t18C54\n\n$ sudo kextload -v -r . /tmp/ksymresolver_test.kext\n$ sudo dmesg | grep ksymresolver\nksymresolver: Darwin Kernel Version 18.2.0: Mon Nov 12 20:24:46 PST 2018; root:xnu-4903.231.4~2/RELEASE_X86_64\nksymresolver: [DBG] vm_kernel_addrperm_ext: 0xdc4c016c669896d3\nksymresolver: [DBG] vm_kernel_slide:        0x000000000de00000\nksymresolver: [DBG] HIB text base:          \u003cptr\u003e\nksymresolver: [DBG] kernel text base:       \u003cptr\u003e\nksymresolver: [DBG] magic:                  0xfeedfacf\nksymresolver: [DBG] cputype:                0x01000007\nksymresolver: [DBG] cpusubtype:             0x00000003\nksymresolver: [DBG] filetype:               0x00000002\nksymresolver: [DBG] ncmds:                  0x00000012\nksymresolver: [DBG] sizeofcmds:             0x00000fd0\nksymresolver: [DBG] flags:                  0x00200001\nksymresolver: [DBG] reserved:               0000000000\nksymresolver: loaded  (version: 0000.00.01 build: 0 ts: Jan 18 2019 18:11:13+0800 uuid: b83eaaf4-48b4-3ccb-a78a-2ffe720359bc)\nksymresolver_test: doprnt_hide_pointers: 1  reset to FALSE\nksymresolver_test: \u0026doprnt_hide_pointers: 0xffffff800ea09164\nksymresolver_test: \u0026hz: 0xffffff800ea77728\nksymresolver_test: hz: 100\nksymresolver_test: \u0026tick: 0xffffff800ea7772c\nksymresolver_test: tick: 10000\nksymresolver_test: boottime_sec: 0xffffff800e6e5720\nksymresolver_test: boottime_sec: 1547806026\nksymresolver_test: bsd_hostname: 0xffffff800e7c29d0\nksymresolver_test: hostname: lynnls-Mac.local len: 16\nksymresolver_test: loaded\n```\n\nAs you can see, first two `\u003cptr\u003e` indicates `doprnt_hide_pointers` is `TRUE`.\n\nAfter resolve and reset `doprnt_hide_pointers`, further pointer formats can be printed as usual form.\n\n---\n\n### *References*\n[Resolving kernel symbols](http://ho.ax/posts/2012/02/resolving-kernel-symbols/)\n\n[Resolving Kernel Symbols in a Post-ASLR macOS World](https://www.zdziarski.com/blog/?p=6901)\n\n[Crafting macOS Root Kits](https://www.zdziarski.com/blog/wp-content/uploads/2017/02/Crafting-macOS-Root-Kits.pdf)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleiless%2Fksymresolver","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fleiless%2Fksymresolver","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleiless%2Fksymresolver/lists"}