vphone-cli/research/kernel_patch_jb/patch_proc_pidinfo.md

B7 patch_proc_pidinfo

Patch Goal

NOP early pid/proc guard branches in proc-info handling to avoid early rejection.

Binary Targets (IDA + Recovered Symbols)

• Recovered symbols:
  • proc_info at 0xfffffe000806d4dc
  • proc_info_internal at 0xfffffe000806d520
• Pattern anchor candidate (switch-like prologue shape) resolved in:
  • function region starting near 0xfffffe000806ded8 (inside proc_info_internal).
• First two early guards selected:
  • 0xfffffe000806df38: CBZ X0, ...
  • 0xfffffe000806df40: CBZ W20, ...

Call-Stack Analysis

• Caller into anchored proc-info internal path:
  • sub_FFFFFE000806D520/internal wrapper chain (xrefs_to includes sub_FFFFFE000806D520 region via 0xfffffe000806d754).
• Both guards are in early prologue validation gates.

Patch-Site / Byte-Level Change

• Site A 0xfffffe000806df38:
  • before bytes: E0 40 00 B4 (CBZ X0, ...)
  • after bytes: 1F 20 03 D5 (NOP)
• Site B 0xfffffe000806df40:
  • before bytes: 34 41 00 34 (CBZ W20, ...)
  • after bytes: 1F 20 03 D5 (NOP)

Pseudocode (Before)

if (proc_ptr == NULL) return EINVAL;
if (pid_or_flavor_guard == 0) return EINVAL;

Pseudocode (After)

// both early guards removed
// continue into proc_info processing path

Symbol Consistency

• proc_info / proc_info_internal recovered names align with the located anchor context.
• Exact proc_pidinfo symbol itself is not recovered, but behavior-level matching is consistent.

Patch Metadata

• Patch document: patch_proc_pidinfo.md (B7).
• Primary patcher module: scripts/patchers/kernel_jb_patch_proc_pidinfo.py.
• Analysis mode: static binary analysis (IDA-MCP + disassembly + recovered symbols), no runtime patch execution.

Target Function(s) and Binary Location

• Primary target: proc_pidinfo path with dual deny checks.
• Patchpoints: two conditional branches NOP-ed in proc-info gating flow.

Kernel Source File Location

• Expected XNU source: bsd/kern/proc_info.c.
• Confidence: high.

Function Call Stack

• Primary traced chain (from Call-Stack Analysis):
• Caller into anchored proc-info internal path:
• sub_FFFFFE000806D520/internal wrapper chain (xrefs_to includes sub_FFFFFE000806D520 region via 0xfffffe000806d754).
• Both guards are in early prologue validation gates.
• The upstream entry(s) and patched decision node are linked by direct xref/callsite evidence in this file.

Patch Hit Points

• Key patchpoint evidence (from Patch-Site / Byte-Level Change):
• Site A 0xfffffe000806df38:
• before bytes: E0 40 00 B4 (CBZ X0, ...)
• after bytes: 1F 20 03 D5 (NOP)
• Site B 0xfffffe000806df40:
• before bytes: 34 41 00 34 (CBZ W20, ...)
• after bytes: 1F 20 03 D5 (NOP)
• The before/after instruction transform is constrained to this validated site.

Current Patch Search Logic

• Implemented in scripts/patchers/kernel_jb_patch_proc_pidinfo.py.
• Site resolution uses anchor + opcode-shape + control-flow context; ambiguous candidates are rejected.
• The patch is applied only after a unique candidate is confirmed in-function.
• Pattern anchor candidate (switch-like prologue shape) resolved in:
• Caller into anchored proc-info internal path:

Validation (Static Evidence)

• Verified with IDA-MCP disassembly/decompilation, xrefs, and callgraph context for the selected site.
• Cross-checked against recovered symbols in research/kernel_info/json/kernelcache.research.vphone600.bin.symbols.json.
• Address-level evidence in this document is consistent with patcher matcher intent.

Expected Failure/Panic if Unpatched

• Proc pidinfo security guards keep denying restricted targets (including pid0-related queries) used by jailbreak tooling.

Risk / Side Effects

• This patch weakens a kernel policy gate by design and can broaden behavior beyond stock security assumptions.
• Potential side effects include reduced diagnostics fidelity and wider privileged surface for patched workflows.

Symbol Consistency Check

• Recovered-symbol status in kernelcache.research.vphone600.bin.symbols.json: partial.
• Canonical symbol hit(s): none (alias-based static matching used).
• Where canonical names are absent, this document relies on address-level control-flow and instruction evidence; analyst aliases are explicitly marked as aliases.
• IDA-MCP lookup snapshot (2026-03-05): 0xfffffe000806d4dc currently resolves to proc_info (size 0x44).

Open Questions and Confidence

• Open question: symbol recovery is incomplete for this path; aliases are still needed for parts of the call chain.
• Overall confidence for this patch analysis: medium (address-level semantics are stable, symbol naming is partial).

Evidence Appendix

• Detailed addresses, xrefs, and rationale are preserved in the existing analysis sections above.
• For byte-for-byte patch details, refer to the patch-site and call-trace subsections in this file.

Runtime + IDA Verification (2026-03-05)

• Verification timestamp (UTC): 2026-03-05T14:55:58.795709+00:00
• Kernel input: /Users/qaq/Documents/Firmwares/PCC-CloudOS-26.3-23D128/kernelcache.research.vphone600
• Base VA: 0xFFFFFE0007004000
• Runtime status: hit (2 patch writes, method_return=True)
• Included in KernelJBPatcher.find_all(): True
• IDA mapping: 2/2 points in recognized functions; 0 points are code-cave/data-table writes.
• IDA mapping status: ok (IDA runtime mapping loaded.)
• Call-chain mapping status: ok (IDA call-chain report loaded.)
• Call-chain validation: 1 function nodes, 2 patch-point VAs.
• IDA function sample: sub_FFFFFE000806DED8
• Chain function sample: sub_FFFFFE000806DED8
• Caller sample: proc_info_internal
• Callee sample: kdp_lightweight_fault, kfree_ext, proc_find_zombref, sub_FFFFFE0007B15AFC, sub_FFFFFE0007B1B508, sub_FFFFFE0007B1C348
• Verdict: valid
• Recommendation: Keep enabled for this kernel build; continue monitoring for pattern drift.
• Key verified points:
• 0xFFFFFE000806DF38 (sub_FFFFFE000806DED8): NOP [_proc_pidinfo pid-0 guard A] | e04000b4 -> 1f2003d5
• 0xFFFFFE000806DF40 (sub_FFFFFE000806DED8): NOP [_proc_pidinfo pid-0 guard B] | 34410034 -> 1f2003d5
• Artifacts: research/kernel_patch_jb/runtime_verification/runtime_verification_report.json
• Artifacts: research/kernel_patch_jb/runtime_verification/ida_runtime_patch_points.json
• Artifacts: research/kernel_patch_jb/runtime_verification/ida_patch_chain_report.json
• Artifacts: research/kernel_patch_jb/runtime_verification/ida_patch_chain_report.md