Analysis: Inspecting Mach Messages in macOS Kernel-Mode Part I: Sniffing the sent Mach messages

Fortigate is an enterprise network security appliance that works with Cloud Bare Metal. Contact us to find out our latest offers!

(lldb) di -b -n ipc_kmsg_send_trampoline

kernelmonitorkit`ipc_kmsg_send_trampoline:

0xffffff7f87a761c0 <+0>: 9c pushfq

0xffffff7f87a761c1 <+1>: 50 pushq %rax

0xffffff7f87a761c2 <+2>: 53 pushq %rbx

0xffffff7f87a761c3 <+3>: 51 pushq %rcx

0xffffff7f87a761c4 <+4>: 52 pushq %rdx

0xffffff7f87a761c5 <+5>: 55 pushq %rbp

0xffffff7f87a761c6 <+6>: 56 pushq %rsi

0xffffff7f87a761c7 <+7>: 57 pushq %rdi

0xffffff7f87a761c8 <+8>: 41 50 pushq %r8

0xffffff7f87a761ca <+10>: 41 51 pushq %r9

0xffffff7f87a761cc <+12>: 41 52 pushq %r10

0xffffff7f87a761ce <+14>: 41 53 pushq %r11

0xffffff7f87a761d0 <+16>: 41 54 pushq %r12

0xffffff7f87a761d2 <+18>: 41 55 pushq %r13

0xffffff7f87a761d4 <+20>: 41 56 pushq %r14

0xffffff7f87a761d6 <+22>: 41 57 pushq %r15

0xffffff7f87a761d8 <+24>: ff 15 02 d7 0d 00 callq *0xdd702(%rip) ; jmp_to_ipc_kmsg_send_pre_handler

0xffffff7f87a761de <+30>: 41 5f popq %r15

0xffffff7f87a761e0 <+32>: 41 5e popq %r14

0xffffff7f87a761e2 <+34>: 41 5d popq %r13

0xffffff7f87a761e4 <+36>: 41 5c popq %r12

0xffffff7f87a761e6 <+38>: 41 5b popq %r11

0xffffff7f87a761e8 <+40>: 41 5a popq %r10

0xffffff7f87a761ea <+42>: 41 59 popq %r9

0xffffff7f87a761ec <+44>: 41 58 popq %r8

0xffffff7f87a761ee <+46>: 5f popq %rdi

0xffffff7f87a761ef <+47>: 5e popq %rsi

0xffffff7f87a761f0 <+48>: 5d popq %rbp

0xffffff7f87a761f1 <+49>: 5a popq %rdx

0xffffff7f87a761f2 <+50>: 59 popq %rcx

0xffffff7f87a761f3 <+51>: 5b popq %rbx

0xffffff7f87a761f4 <+52>: 58 popq %rax

0xffffff7f87a761f5 <+53>: 9d popfq

0xffffff7f87a761f6 <+54>: 90 nop

0xffffff7f87a761f7 <+55>: 90 nop

0xffffff7f87a761f8 <+56>: 90 nop

0xffffff7f87a761f9 <+57>: 90 nop

0xffffff7f87a761fa <+58>: 90 nop

0xffffff7f87a761fb <+59>: 90 nop

0xffffff7f87a761fc <+60>: e8 ff e9 2d 7c callq 0xffffff8003d54c00 ; ipc_kmsg_send at ipc_kmsg.c:1793

0xffffff7f87a76201 <+65>: 85 c0 testl %eax, %eax

0xffffff7f87a76203 <+67>: 90 nop

0xffffff7f87a76204 <+68>: 90 nop

0xffffff7f87a76205 <+69>: 90 nop

0xffffff7f87a76206 <+70>: 90 nop

0xffffff7f87a76207 <+71>: 90 nop

0xffffff7f87a76208 <+72>: 90 nop

0xffffff7f87a76209 <+73>: 90 nop

0xffffff7f87a7620a <+74>: 90 nop

0xffffff7f87a7620b <+75>: 90 nop

0xffffff7f87a7620c <+76>: 90 nop

0xffffff7f87a7620d <+77>: 90 nop

0xffffff7f87a7620e <+78>: 90 nop

0xffffff7f87a7620f <+79>: 90 nop

0xffffff7f87a76210 <+80>: 9c pushfq

0xffffff7f87a76211 <+81>: 53 pushq %rbx

0xffffff7f87a76212 <+82>: 51 pushq %rcx

0xffffff7f87a76213 <+83>: 52 pushq %rdx

0xffffff7f87a76214 <+84>: 55 pushq %rbp

0xffffff7f87a76215 <+85>: 56 pushq %rsi

0xffffff7f87a76216 <+86>: 57 pushq %rdi

0xffffff7f87a76217 <+87>: 41 50 pushq %r8

0xffffff7f87a76219 <+89>: 41 51 pushq %r9

0xffffff7f87a7621b <+91>: 41 52 pushq %r10

0xffffff7f87a7621d <+93>: 41 53 pushq %r11

0xffffff7f87a7621f <+95>: 41 54 pushq %r12

0xffffff7f87a76221 <+97>: 41 55 pushq %r13

0xffffff7f87a76223 <+99>: 41 56 pushq %r14

0xffffff7f87a76225 <+101>: 41 57 pushq %r15

0xffffff7f87a76227 <+103>: 48 31 db xorq %rbx, %rbx

0xffffff7f87a7622a <+106>: 89 c3 movl %eax, %ebx

0xffffff7f87a7622c <+108>: 48 89 de movq %rbx, %rsi

0xffffff7f87a7622f <+111>: ff 15 b3 d6 0d 00 callq *0xdd6b3(%rip) ; jmp_to_ipc_kmsg_send_post_handler

0xffffff7f87a76235 <+117>: 41 5f popq %r15

0xffffff7f87a76237 <+119>: 41 5e popq %r14

0xffffff7f87a76239 <+121>: 41 5d popq %r13

0xffffff7f87a7623b <+123>: 41 5c popq %r12

0xffffff7f87a7623d <+125>: 41 5b popq %r11

0xffffff7f87a7623f <+127>: 41 5a popq %r10

0xffffff7f87a76241 <+129>: 41 59 popq %r9

0xffffff7f87a76243 <+131>: 41 58 popq %r8

0xffffff7f87a76245 <+133>: 5f popq %rdi

0xffffff7f87a76246 <+134>: 5e popq %rsi

0xffffff7f87a76247 <+135>: 5d popq %rbp

0xffffff7f87a76248 <+136>: 5a popq %rdx

0xffffff7f87a76249 <+137>: 59 popq %rcx

0xffffff7f87a7624a <+138>: 5b popq %rbx

0xffffff7f87a7624b <+139>: 9d popfq

0xffffff7f87a7624c <+140>: ff 25 9e d6 0d 00 jmpq *0xdd69e(%rip) ; jmp_back_to_ipc_kmsg_send_call

0xffffff7f87a76252 <+146>: cc int3

0xffffff7f87a76253 <+147>: 0f 0b ud2

(lldb)

Fortigate is an enterprise network security appliance that works with Cloud Bare Metal. Contact us to find out our latest offers!

Comments are closed.