Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Mac OS Kernel Debugging
Ethernet Debugging Instructions
Setup the debug target system
On OSOperating System X El Capitan, you might have to disable system integrity protection before you can debug the kernel:
- Boot into recovery mode with cmd-R
- Open Terminal and run: csrutil disable
Here are the rest of the steps:
-
Find the precise kernel version
sw_vers | grep BuildVersion - Install the KDK for the precise kernel version
- Copy the kernel.development kernel from the KDK to /System/Library/Kernels/
- Identify the proper network interface for debugging. In this example it's en0
-
Configure nvram boot-args
nvram boot-args "debug=0x146 kcsuffix=development pmuflags=1 kext-dev-mode=1 slide=0 kdp_match_name=en0 -v" - Reboot the target system
- Get the IP address
Setup the host debugger system
- Install the KDK matching the target system's kernel version
- Install the XNU sources for the target system's kernel version
-
Run LLDB for the matching kernel
xcrun lldb /Library/Developer/KDKs/KDK_XXX/System/Library/Kernels/kernel.development
Begin Debugging
-
Trigger a breakpoint on the debug target, since you can't do left-cmd + right-cmd + power on a VM, you can also do this:
dtrace -w -n "BEGIN { breakpoint{}; }" -
Attach to the debug target from the host debugger's lldb session
settings set target.load-script-from-symbol-file true kdp-remote X.X.X.X settings set target.source-map /SourceCache/xnu/xnu-XXXX /path/to/xnu/xnu-XXXX
You should have an active debug session now. Have fun, hope you had a snapshot.
Thunderbolt/Firewire Debugging (on El Capitan)
You can debug OSXApple operating system machines using Firewire using Thunderbolt->FireWire adapters. It's similar to the usual debug setup with a few key differences:
1. The target system uses boot-args that indicate firewire debugging will happen using a non-built-in firewire adapter
2. The debugger system uses the fwkdp command to proxy debug command on localhost to the target system using firewire
Debuger Host setup
- As root, run fwkdp -v to begin listening for firewire debug events. This tool will allow lldb to attach to proxy debug commands through localhost
- lldb the kernel/KDK of choice (see above)
Debug Target setup
-
Set boot-args:
nvram boot-args="debug=0x146 kdp_match_name=firewire fwkdp=0x8000 fwdebug=0x40 pmuflags=1 -v"You can view all of the debug= options in osfmk/kern/debug.h. The fwkdp=0x8000 option instructs IOFireWireFamily.kext's AppleFWOHCI_KDP plugin to use a non-built-in firewire/thunderbolt adapter for debugging. The fwdebug=0x40 option tells the AppleFWOHCI_KDP driver to be more verbose (helpful for troubleshooting).
- Disable system integrity protection, as documented above.
- reboot
Known debug options
According to osfmk/kern/debug.h:
#define DB_HALT 0x1
#define DB_PRT 0x2
#define DB_NMI 0x4
#define DB_KPRT 0x8
#define DB_KDB 0x10
#define DB_SLOG 0x20
#define DB_ARP 0x40
#define DB_KDP_BP_DIS 0x80
#define DB_LOG_PI_SCRN 0x100
#define DB_KDP_GETC_ENA 0x200
#define DB_KERN_DUMP_ON_PANIC 0x400 /* Trigger core dump on panic*/
#define DB_KERN_DUMP_ON_NMI 0x800 /* Trigger core dump on NMI */
#define DB_DBG_POST_CORE 0x1000 /*Wait in debugger after NMI core */
#define DB_PANICLOG_DUMP 0x2000 /* Send paniclog on panic,not core*/
#define DB_REBOOT_POST_CORE 0x4000 /* Attempt to reboot after
* post-panic crashdump/paniclog
* dump.
*/
#define DB_NMI_BTN_ENA 0x8000 /* Enable button to directly trigger NMI */
#define DB_PRT_KDEBUG 0x10000 /* kprintf KDEBUG traces */