PPSSPP iOS Port

[the avenger]

i am starting to think the error is in the code not in the OS,as jailbreaking removes the limitations for jit compiling,to quote from the ios hacker's handbook:

Quote:vm_map_enter
When memory is mapped into the address space of a process, the kernel function vm_map_enter() is called to allocate a range in the virtual
address map. You can trigger this function, for example, by using the mmap() system call. In the context of a jailbreak, this function is interesting
because it enforces the rule that mapped memory cannot be writable and executable at the same time. The following code enforces this rule. If you
want to see the full code of the function, have a look into the file /osfmk/vm/vm_map.c. As you can see in the code, the VM_PROT_EXECUTE flag is
cleared in case the VM_PROT_WRITE flag is also set:
kern_return_t vm_map_enter(
vm_map_t map,
vm_map_offset_t *address, /* IN/OUT */
vm_map_size_t size,
vm_map_offset_t mask,
int flags,
vm_object_t object,
vm_object_offset_t offset,
boolean_t needs_copy,
vm_prot_t cur_protection,
vm_prot_t max_protection,
vm_inherit_t inheritance)
{
...
if (cur_protection & VM_PROT_WRITE){
if ((cur_protection & VM_PROT_EXECUTE) && !(flags &
VM_FLAGS_MAP_JIT)){
printf("EMBEDDED: %s curprot cannot be write+execute.
turning off execute\n", _PRETTY_FUNCTION_);
cur_protection &= ∼VM_PROT_EXECUTE;
}
}
As you saw in Chapter 4, there is an exception to the rule for so-called JIT (just-in-time) mappings. This is a special type of memory area that is
allowed to be writable and executable at the same time, which is required for the JIT JavaScript compiler inside MobileSafari. An application can
make use of this exception only one time and only if it has the dynamic code-signing entitlement.
So far this is true only for MobileSafari. All other applications cannot have self-modifying code, dynamic code generators, or JIT compilers, with
the exception of the dynamic code-signing vulnerability found by Charlie Miller, which is discussed in Chapter 4. For a full jailbreak, this is an
unwanted limitation, because it disallows runtime patching of applications, which is required for the popular MobileSubstrate. Additionally, a
number of emulators, which are available for jailbroken iPhones, require self-modifying code.
To find the best way to patch this check you should have a look at the iOS kernel binary. Though there is no symbol for the vm_map_enter()
function, it is very easy to find the function by looking for strings containing vm_map_enter. A look at the ARM assembly of the check shows that multiple different one-byte patches exist to kill the check. For example, the AND.W R0, R1, #6 can be changed into AND.W R0, R1, #8; or the BIC.W
R0, R0, #4 can be changed into BIC.W R0, R0, #0:
800497C6 LDR R1, [R7,#cur_protection]
800497C8 AND.W R0, R4, #0x80000
800497CC STR R0, [SP,#0xB8+var_54]
800497CE STR R1, [SP,#0xB8+var_78]
800497D0 AND.W R0, R1, #6
800497D4 CMP R0, #6
800497D6 ITT EQ
800497D8 LDREQ R0, [SP,#0xB8+var_54]
800497DA CMPEQ R0, #0
800497DC BNE loc_800497F0
800497DE LDR.W R1, =aKern_return_
800497E2 MOVS R0, #0
800497E4 BL sub_8001D608
800497E8 LDR R0, [R7,#cur_protection]
800497EA BIC.W R0, R0, #4
800497EE STR R0, [SP,#0xB8+var_78]
For people who jailbreak their iPhones just for the purpose of security research or to have shell access, this patch is not required. It is actually
counterproductive to have this limitation patched, because the phone behaves less like a default iPhone.
vm_map_protect
When the protection on mapped memory is changed, the kernel function vm_map_protect() is called. You can trigger this, for example, by using the
mprotect() system call. Similar to the vm_map_enter() function, it does not allow changing the protection to writable and executable at the same
time. The following code enforces this rule. You can also find the full code of this function in the file /osfmk/vm/vm_map.c, if you want to look at it in
more detail. As you can see in the code, the VM_PROT_EXECUTE flag is again cleared in case the VM_PROT_WRITE flag is also set:
kern_return_t vm_map_protect(
register vm_map_t map,
register vm_map_offset_t start,
register vm_map_offset_t end,
register vm_prot_t new_prot,
register boolean_t set_max)
{
. . .
#if CONFIG_EMBEDDED
if (new_prot & VM_PROT_WRITE) {
if ((new_prot & VM_PROT_EXECUTE) && !(current->used_for_jit)) {
printf(„EMBEDDED: %s can't have both write and exec at the
same time\n", _FUNCTION_);
new_prot &= ∼VM_PROT_EXECUTE;
}
}
#endif
Again you can see that an exception is made only for memory ranges that are used for JIT, which can be created only by applications with the
dynamic code-signing entitlement. No other applications can use mprotect() to make a memory area writable and executable at the same time.
The standard jailbreaks therefore patch this check, to allow applications to make previously allocated memory writable and executable.
To patch this function it first has to be found. Although there is no kernel symbol pointing to it, there is a reference to the string vm_map_protect
within the function, which makes it easy to find. A look at the ARM disassembly shows you that, again, two alternative one-byte patches can be
applied to remove the security check. The AND.W R1, R6, #6 can be changed into AND.W R1, R6, #8; or the BIC.W R6, R6, #4 can be changed
into BIC.W R6, R6, #0:
8004A950 AND.W R1, R6, #6
8004A954 CMP R1, #6
8004A956 IT EQ
8004A958 TSTEQ.W R0, #0x40000000
8004A95C BNE loc_8004A96A
8004A95E BIC.W R6, R6, #4
Because of this patch, jailbreaking weakens the memory protection of the iOS device. We suggest applying this patch only if the user of the
jailbreak wants to run applications that require self-modifying code. The problem with these patches is that they disable the non-executable memory
restrictions, so that remote attacks against iPhone applications do not need to be implemented in 100 percent ROP. Instead, these attacks (or
malware) just need a short ROP stub that uses mprotect() to make the injected code executable.