Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Mac OS Kernel Debugging
Ethernet Debugging Instructions
Setup the debug target system
On OSOperating System X El Capitan, you might have to disable system integrity protection before you can debug the kernel:
- Boot into recovery mode with cmd-R
- Open Terminal and run: csrutil disable
Here are the rest of the steps:
-
Find the precise kernel version
sw_vers | grep BuildVersion - Install the KDK for the precise kernel version
- Copy the kernel.development kernel from the KDK to /System/Library/Kernels/
- Identify the proper network interface for debugging. In this example it's en0
-
Configure nvram boot-args
nvram boot-args "debug=0x146 kcsuffix=development pmuflags=1 kext-dev-mode=1 slide=0 kdp_match_name=en0 -v" - Reboot the target system
- Get the IP address
Setup the host debugger system
- Install the KDK matching the target system's kernel version
- Install the XNU sources for the target system's kernel version
-
Run LLDB for the matching kernel
xcrun lldb /Library/Developer/KDKs/KDK_XXX/System/Library/Kernels/kernel.development
Begin Debugging
-
Trigger a breakpoint on the debug target, since you can't do left-cmd + right-cmd + power on a VM, you can also do this:
dtrace -w -n "BEGIN { breakpoint{}; }" -
Attach to the debug target from the host debugger's lldb session
settings set target.load-script-from-symbol-file true kdp-remote X.X.X.X settings set target.source-map /SourceCache/xnu/xnu-XXXX /path/to/xnu/xnu-XXXX
You should have an active debug session now. Have fun, hope you had a snapshot.
Thunderbolt/Firewire Debugging (on El Capitan)
You can debug OSXApple operating system machines using Firewire using Thunderbolt->FireWire adapters. It's similar to the usual debug setup with a few key differences:
1. The target system uses boot-args that indicate firewire debugging will happen using a non-built-in firewire adapter
2. The debugger system uses the fwkdp command to proxy debug command on localhost to the target system using firewire
Debuger Host setup
- As root, run fwkdp -v to begin listening for firewire debug events. This tool will allow lldb to attach to proxy debug commands through localhost
- lldb the kernel/KDK of choice (see above)
Debug Target setup
-
Set boot-args:
nvram boot-args="debug=0x146 kdp_match_name=firewire fwkdp=0x8000 fwdebug=0x40 pmuflags=1 -v"You can view all of the debug= options in osfmk/kern/debug.h. The fwkdp=0x8000 option instructs IOFireWireFamily.kext's AppleFWOHCI_KDP plugin to use a non-built-in firewire/thunderbolt adapter for debugging. The fwdebug=0x40 option tells the AppleFWOHCI_KDP driver to be more verbose (helpful for troubleshooting).
- Disable system integrity protection, as documented above.
- reboot