4 ms·

> Strongly advise anyone from running this on any system. Oh come on. Your para 2-4 are serious conceptual defects with xnu_override in general, but this is th

by munin 9y ago

> Strongly advise anyone from running this on any system. Oh come on. Your para 2-4 are serious conceptual defects with xnu_override in general, but this is the kind of hacker shit you'd expect to find in something that will live patch your kernel code. At the point in time you find yourself turning off SIP to load some code to hot patch your kernel, you've long since crossed the Rubicon of caring about running particularly good code. The odds are good that the functions this thing is set up patch do hold with your first two invariants (RAX is scratch, there's 12 bytes in the entry BB). The third is the race, and you'll probably win this race most of the time. "You'll probably win this race most of the time" shouldn't be in any serious engineering design document and is probably grounds for demotion or firing if you bring it up as a defense during a design or code review, but that isn't what's going on here. This is some hacker shit posted to github.

dmitrygr 9y ago
And if this project was one monolithic thing, I'd agree. But the page sells this xnu_override as a "reusable library" which might lead someone to try to reuse it in another place. This is scary and hence my warning. Hell, tomorrow's apple 10.13.0.0.0.0.0.0.minor.insignificant.0.1 patch could change these "invariants"
- munin 9y ago
  You're right, and I was reacting poorly to the "don't run this on anything" statement. It's some hacker magic off github, caveat empor. You're also right that future updates could break it. It's brittle. I won't be running it myself. I bet, though, that 99% of the time, it works every time, and for its use case, that's "good enough." Hot patching the kernel is scary, though, and hopefully no one walks away from looking at that github thinking "oh yes, I know so many problems that can be solved by hot patching the running kernel" because honestly getting the act of patching the physical code itself is only the start of your troubles.

by munin 9y ago

dmitrygr 9y ago

And if this project was one monolithic thing, I'd agree. But the page sells this xnu_override as a "reusable library" which might lead someone to try to reuse it in another place. This is scary and hence my warning. Hell, tomorrow's apple 10.13.0.0.0.0.0.0.minor.insignificant.0.1 patch could change these "invariants"

munin 9y ago
You're right, and I was reacting poorly to the "don't run this on anything" statement. It's some hacker magic off github, caveat empor. You're also right that future updates could break it. It's brittle. I won't be running it myself. I bet, though, that 99% of the time, it works every time, and for its use case, that's "good enough." Hot patching the kernel is scary, though, and hopefully no one walks away from looking at that github thinking "oh yes, I know so many problems that can be solved by hot patching the running kernel" because honestly getting the act of patching the physical code itself is only the start of your troubles.