steven-michaud / HookCase

Tool for reverse engineering macOS/OS X

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Kernel panic on 11.3.1

retpoline opened this issue · comments

Hi there,

First off, awesome project!

Unfortunately, as soon as I got it setup and tried it out, got a kernel panic.

$ HC_INSERT_LIBRARY=/Users/test/HookCase/Examples/xpcproxy/hook.dylib open test.html
.... panic
$ /usr/bin/kmutil showloaded | grep HookCase
No variant specified, falling back to release
  172    0 0xffffff7f9b453000 0x11000    0x11000    org.smichaud.HookCase (5.0.5) FE389BA6-A958-3916-AF43-3067D3DD3C9D <8 6 5 3 2 1>
$ sysctl -a | grep osrelease
kern.osrelease: 20.4.0

Any ideas?

Thanks!

Thanks for your report. It'll be hard to test on macOS 11.3.1 -- I generally only have the latest available (minor) version of each major release of macOS. The HookCase 5.0.5 release worked around Apple breakage introduced in macOS 11.4, which also caused kernel panics. (See #28.) Try the previous release (HookCase 5.0.4) and let me know your results. It's possible I did something in the 5.0.5 release to mess things up on macOS 11.3.X.

I think I can manage to (re)create a macOS 11.3 partition to test on. But I'll wait for your results before doing that.

Edit: And if HookCase 5.0.4 doesn't help, try HookCase 5.0.3.

$ HC_INSERT_LIBRARY=/Users/test/HookCase/Examples/xpcproxy/hook.dylib open test.html

By the way, I tried this with HookCase 5.0.5 on macOS 11.5.2 and had no kernel panic or any other problems.

Thanks for your quick reply, Steven!

I actually just decided to do the upgrade as this is a test box anyways and now running 11.5.2 /w HookCase just fine.

Glad to hear that upgrading to 11.5.2 fixed your problem.