fixed write_mem calling mach_vm_protect_trap on ios

Author: Antibioticss

.github/workflows/c-cpp.yml

@@ -11,13 +11,13 @@ jobs:
     runs-on: macos-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: build macos libraries
         run: ./build.sh -t macosx -v 10.15
 
       - name: upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: tinyhook-macosx
           path: |
@@ -30,7 +30,7 @@ jobs:
         run: ./build.sh -t iphoneos -v 12.0
 
       - name: upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: tinyhook-iphoneos
           path: |
@@ -51,7 +51,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: run test
         run: make test

src/memory.c

@@ -6,21 +6,25 @@
     #include <mach/mach_error.h> // mach_error_string()
 #endif
 
+#if TARGET_OS_OSX
+    #define mach_vm_protect mach_vm_protect_trap
+
 __attribute__((naked)) static kern_return_t mach_vm_protect_trap(mach_port_name_t task, mach_vm_address_t address,
                                                                  mach_vm_size_t size, boolean_t set_maximum,
                                                                  vm_prot_t new_protection) {
-#ifdef __aarch64__
+    #ifdef __aarch64__
     asm volatile("mov    x16, #-0xe\n"
                  "svc    #0x80\n"
                  "ret");
-#elif __x86_64__
+    #elif __x86_64__
     asm volatile(".intel_syntax\n"
                  "mov    r10, rcx\n"
                  "mov    eax, 0x100000e\n"
                  "syscall\n"
                  "ret");
-#endif
+    #endif
 }
+#endif
 
 static inline void copy_mem(void *destination, const void *source, size_t len) {
     unsigned char *dst = (unsigned char *)destination;
@@ -65,13 +69,13 @@ int write_mem(void *destination, const void *source, size_t len) {
     ARG_CHECK(len != 0);
     mach_port_t task = mach_task_self();
     mach_vm_address_t dst = (mach_vm_address_t)destination;
-    int kr = mach_vm_protect_trap(task, dst, len, FALSE, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY);
+    int kr = mach_vm_protect(task, dst, len, FALSE, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY);
     if (kr != 0) {
         LOG_ERROR("mach_vm_protect failed for address %p: %s", destination, mach_error_string(kr));
         return kr;
     }
     copy_mem(destination, source, len);
-    mach_vm_protect_trap(task, dst, len, FALSE, VM_PROT_READ | VM_PROT_EXECUTE);
+    mach_vm_protect(task, dst, len, FALSE, VM_PROT_READ | VM_PROT_EXECUTE);
     // might fail when editing __DATA, but not a big deal
     return 0;
 }

src/tinyhook.c

@@ -21,7 +21,7 @@ static inline int a64_movz_movk(uint16_t rd, uint64_t imm64, uint32_t **outputp)
     bool cleaned = false;
     uint32_t *output = *outputp;
     for (int i = 0; imm64; imm64 >>= 16, i++) {
-        uint64_t imm16 = imm64 & 0xffff;
+        uint16_t imm16 = imm64 & 0xffff;
         if (imm16) {
             uint32_t insn = (i << 21) | (imm16 << 5) | rd;
             if (cleaned)
@@ -53,8 +53,8 @@ static int calc_jump(void *output, void *src, void *dst, bool link) {
             // adrp    x17, imm
             // add     x17, x17, imm    ; x17 -> dst
             jump_size = 8 + 4;
-            *outcode++ = AARCH64_ADRP | ((gap & 0x3) << 29) | ((gap & 0x1ffffc) << 3);
-            *outcode++ = AARCH64_ADD | ((int64_t)dst & 0xfff) << 10;
+            *outcode++ = AARCH64_ADRP | (uint32_t)((gap & 0x3) << 29) | (uint32_t)((gap & 0x1ffffc) << 3);
+            *outcode++ = AARCH64_ADD | (uint32_t)((int64_t)dst & 0xfff) << 10;
         }
         else {
             // movz    x17, lowbit
@@ -64,11 +64,11 @@ static int calc_jump(void *output, void *src, void *dst, bool link) {
         *outcode = (link ? AARCH64_BLR : AARCH64_BR);
     }
 #elif __x86_64__
-    if (gap <= INT32_MAX && gap >= INT32_MIN) { // 32 bit imm
+    if (gap - 5 <= INT32_MAX && gap - 5 >= INT32_MIN) { // 32 bit imm
         // jmp/call imm    ; go to dst
         jump_size = 5;
         *(uint8_t *)output = (link ? X86_64_CALL : X86_64_JMP);
-        *(int32_t *)(output + 1) = gap - 5;
+        *(int32_t *)(output + 1) = (int32_t)gap - 5;
     }
     else {
         // jmp [rip]
@@ -100,7 +100,7 @@ static inline void save_header(void **src_p, void **dst_p, int min_len) {
             if (gap <= 0x100000 - 1 && gap >= -0x100000) { // 21 bit imm
                 // modify the immediate (len: 4 -> 4)
                 insn &= 0x9f00001f; // clean the immediate
-                *dst++ = insn | ((gap & 0x3) << 29) | ((gap & 0x1ffffc) << 3);
+                *dst++ = insn | (uint32_t)((gap & 0x3) << 29) | (uint32_t)((gap & 0x1ffffc) << 3);
             }
             else {
                 // use movz + movk to get the address (len: 4 -> 16)