1 of 13

XNU Important Ports

CSE 598 – Applied Vulnerability Research

Fall 2024

​

Adam Doupé�Arizona State University

​

2 of 13

Important Ports

  • Mach ports where RECEIVE right is held by the kernel
  • Therefore, SEND right is what’s needed to interact with the port

2

Adam Doupé, CSE 598 Applied Vulnerability Research

​

3 of 13

host Port

  • Access to host-level information and diagnostics
  • mach_host_self()
  • <mach/mach_host.h>
    • host_info
    • host_kernel_version
  • Access to other ports
    • IO Master port
    • Clock port
    • Processor Set port

3

Adam Doupé, CSE 598 Applied Vulnerability Research

​

4 of 13

host_priv Port

  • Host Privileged port with security-sensitive operations
  • host_get_host_priv_port()
  • <mach/host_priv.h>
    • host_reboot
    • vm_wire
    • host_set_exception_ports
  • Only for root

4

Adam Doupé, CSE 598 Applied Vulnerability Research

​

5 of 13

Host Special Ports

  • Fixed numbered ports
    • Don’t need bootstrap server
  • <mach/host_special_ports.h>
  • First seven are reserved for kernel, rest are used by system daemons

5

Adam Doupé, CSE 598 Applied Vulnerability Research

​

6 of 13

Tasks and Processes

  • Mach just has concept of threads and tasks
  • BSD layer means mapping BSD process to Mach task
    • proc: bsd/sys/proc_internal.h
    • task: osfmk/kern/task.h
    • uthread: bsd/sys/user.h
    • thread: osfmk/kern/thread.h
  • task_for_pid
  • pid_for_task

6

Adam Doupé, CSE 598 Applied Vulnerability Research

​

7 of 13

Task Ports

  • Used to control the specific task
  • mach_task_self()
  • <mach/task.h>
    • task_terminate
    • task_suspend
    • thread_create
  • Access to many other important task-specific ports
  • Allow remote manipulation of task if you obtain a SEND right

7

Adam Doupé, CSE 598 Applied Vulnerability Research

​

8 of 13

Task ports for VM access

  • Virtual Memory access/modification requires a task port
  • <mach/mach_vm.h>
    • mach_vm_write
    • mach_vm_read
  • Can inject new threads, new memory, new tasks, etc…

8

Adam Doupé, CSE 598 Applied Vulnerability Research

​

9 of 13

A special task port

  • kernel_task is a special task port that represents the kernel
  • If you can obtain a SEND right to it, you can read/write kernel memory
  • Protected by SIP and other security mechanisms

9

Adam Doupé, CSE 598 Applied Vulnerability Research

​

10 of 13

Thread Ports

  • Ports to control/modify threads
  • <mach/thread_act.h>
    • thread_terminate
    • thread_suspend
    • thread_set_exception_ports

​

10

Adam Doupé, CSE 598 Applied Vulnerability Research

​

11 of 13

Processor Set Ports

  • Originally used to group processors into a collection
    • Now only one processor set available
  • However, has two very special methods:
    • processor_set_tasks
    • processor_set_threads

​

11

Adam Doupé, CSE 598 Applied Vulnerability Research

​

12 of 13

Processor Set Ports Exploitation

​

12

Adam Doupé, CSE 598 Applied Vulnerability Research

​

13 of 13

Exception Ports

  • Mechanism to handle exceptions, several levels
    • thread exception port sent message sent first
    • If not handled, task exception port sent message
    • If not handled, host exception port sent message
      • launchd owns host exception port
  • Exception handler can read memory, modify state, etc…
  • Allows custom exception/crash handlers

13

Adam Doupé, CSE 598 Applied Vulnerability Research

​