Enhance filesystem access initialization and logging in FileUtils and FileManagerView for improved debugging and error handling

jurre111 · jurre111 · commit 2214243ec3c6 · 2026-04-03T21:10:20.000+02:00
diff --git a/lara/pe/fileutils.m b/lara/pe/fileutils.m
@@ -214,13 +214,18 @@ + (BOOL)enableSandboxAccess:(NSString *)path {
 
 + (BOOL)initializeFilesystemAccess {
     printf("FILE-UTILS: initializeFilesystemAccess called\n");
-    printf("FILE-UTILS: Initializing filesystem access for /private/var...\n");
+    printf("FILE-UTILS: Attempting to enable full filesystem access via root token...\n");
     
-    // Enable access to /private/var specifically with sandbox token
-    // This grants access to the target directory through sandbox extensions
-    printf("FILE-UTILS: Calling enableSandboxAccessCached(@\"/private/var\")\n");
+    // Try to get root token first for maximum access
+    printf("FILE-UTILS: Calling enableSandboxAccessCached(@\"/\") for root access\n");
+    if ([self enableSandboxAccessCached:@"/"]) {
+        printf("FILE-UTILS: Successfully enabled root access via sandbox token\n");
+        return YES;
+    }
+    
+    printf("FILE-UTILS: Root token failed, falling back to /private/var\n");
     if (![self enableSandboxAccessCached:@"/private/var"]) {
-        printf("FILE-UTILS ERROR: Failed to enable /private/var access\n");
+        printf("FILE-UTILS ERROR: Failed to enable both root and /private/var access\n");
         return NO;
     }
     
diff --git a/lara/pe/sandbox.m b/lara/pe/sandbox.m
@@ -13,6 +13,14 @@
 #include <string.h>
 #include <dlfcn.h>
 
+// Kernel read/write imports from Darksword exploit
+extern uint64_t ds_kread64(uint64_t address);
+extern uint32_t ds_kread32(uint64_t address);
+extern void ds_kwrite64(uint64_t address, uint64_t value);
+extern void ds_kwrite32(uint64_t address, uint32_t value);
+extern void ds_kread(uint64_t address, void *buffer, uint64_t size);
+extern void ds_kwrite(uint64_t address, void *buffer, uint64_t size);
+
 // Sandbox extension token handling
 typedef const struct __sandbox_extension_token * sandbox_extension_t;
 
@@ -27,12 +35,56 @@ typedef int (*sandbox_extension_issue_file_t)(const char *extension_class, int s
 static sandbox_extension_consume_t real_sandbox_extension_consume = NULL;
 static sandbox_extension_release_t real_sandbox_extension_release = NULL;
 
+/**
+ * Attempt to patch sandbox extension policy in kernel memory
+ * Based on iOS 18.3 sandbox escape that rewrites extension class names
+ * This searches kernel memory for sandbox extension class strings and patches them
+ */
+static void patch_sandbox_in_kernel(void) {
+    printf("SANDBOX: Attempting kernel memory sandbox patching...\n");
+    fflush(stdout);
+    
+    // These are common sandbox extension class strings we might find in kernel
+    const char *target_strings[] = {
+        "com.apple.sandbox.container",
+        "com.apple.app-sandbox",
+        "http://com.apple",
+        "app-sandbox",
+    };
+    
+    const char *replacement = "com.apple.app-sandbox.read-write";
+    size_t replacement_len = strlen(replacement);
+    
+    printf("SANDBOX: Warning - kernel memory patching is complex and device-specific\n");
+    printf("SANDBOX: This requires matching iOS version-specific offsets\n");
+    printf("SANDBOX: Attempting to patch sandbox policy...\n");
+    fflush(stdout);
+    
+    // Note: The actual patching would require finding the exact kernel structures
+    // and offsets for this specific iOS version and device. This is a placeholder
+    // for the approach described in the sandbox escape tweets.
+    // 
+    // In a real implementation, you would:
+    // 1. Find kernel slide from Darksword
+    // 2. Locate sandbox policy structures at known offsets
+    // 3. Identify the extension class string location
+    // 4. Patch it using ds_kwrite
+    
+    // For now, we just log that we attempted this approach
+    printf("SANDBOX: Kernel patching approach - would require device-specific offsets\n");
+    printf("SANDBOX: Falling back to API-level approaches\n");
+    fflush(stdout);
+}
+
 static void init_sandbox_apis(void) {
     static dispatch_once_t onceToken;
     dispatch_once(&onceToken, ^{
         printf("SANDBOX: Initializing sandbox APIs via dlsym...\n");
         fflush(stdout);
         
+        // Attempt kernel memory patching first (iOS 18 sandbox escape technique)
+        patch_sandbox_in_kernel();
+        
         // Try to find the sandbox functions in the loaded framework
         // These are private APIs, so they might be in different places depending on iOS version
         void *handle = dlopen(NULL, RTLD_GLOBAL);
@@ -94,6 +146,9 @@ static void init_sandbox_apis(void) {
  * Based on the tweet approach for unrestricted file access
  */
 char* getTokenForPath(const char *path) {
+    printf("SANDBOX DEBUG: getTokenForPath START\n");
+    fflush(stdout);
+    
     if (!path) {
         printf("SANDBOX: getTokenForPath called with NULL path\n");
         fflush(stdout);
@@ -104,13 +159,17 @@ static void init_sandbox_apis(void) {
     fflush(stdout);
     
     init_sandbox_apis();
+    printf("SANDBOX DEBUG: After init_sandbox_apis\n");
+    fflush(stdout);
     
     if (!real_sandbox_extension_issue_file) {
-        printf("SANDBOX ERROR: sandbox_extension_issue_file not found at runtime\n");
+        printf("SANDBOX ERROR: sandbox_extension_issue_file not found at runtime (NULL pointer)\n");
         fflush(stdout);
         return NULL;
     }
     
+    printf("SANDBOX: sandbox_extension_issue_file found at: %p\n", real_sandbox_extension_issue_file);
+    fflush(stdout);
     printf("SANDBOX: Calling sandbox_extension_issue_file for: %s\n", path);
     fflush(stdout);
     
@@ -121,13 +180,35 @@ static void init_sandbox_apis(void) {
         kSBXExtensionClass_ReadWrite,
         kSBXExtensionClass_Read,
         kSBXExtensionClass_Write,
-        kSBXExtensionClass_Empty
+        kSBXExtensionClass_Empty,
+        NULL  // Try NULL as last resort
     };
     
     int result = -1;
-    for (int i = 0; i < 4; i++) {
+    printf("SANDBOX DEBUG: Starting extension class loop\n");
+    fflush(stdout);
+    
+    for (int i = 0; extension_classes[i] != NULL || i == 4; i++) {
         const char *ext_class = extension_classes[i];
-        printf("SANDBOX: Trying extension class: '%s'\n", ext_class);
+        
+        // Safely log even if pointer is unusual
+        if (ext_class) {
+            printf("SANDBOX DEBUG: Loop iteration %d, ext_class='%s'\n", i, ext_class);
+        } else {
+            printf("SANDBOX DEBUG: Loop iteration %d, ext_class=NULL\n", i);
+        }
+        fflush(stdout);
+        
+        // Extra safety: check function pointer again
+        if (!real_sandbox_extension_issue_file) {
+            printf("SANDBOX ERROR: Function pointer became NULL in loop!\n");
+            fflush(stdout);
+            break;
+        }
+        
+        // Call the API - be very explicit about parameters
+        printf("SANDBOX DEBUG: About to call sandbox_extension_issue_file(ext_class=%p, flags=0, path=%p, token_out=%p)\n",
+               ext_class, (void*)path, &token);
         fflush(stdout);
         
         result = real_sandbox_extension_issue_file(
@@ -137,18 +218,21 @@ static void init_sandbox_apis(void) {
             &token
         );
         
-        printf("SANDBOX: Result for '%s': error=%d, token=%p\n", ext_class, result, token);
+        printf("SANDBOX: Extension class '%s': result=%d, token=%p\n", 
+               ext_class ? ext_class : "NULL", result, token);
         fflush(stdout);
         
         if (result == 0 && token != NULL) {
-            printf("SANDBOX: SUCCESS with extension class: '%s'\n", ext_class);
+            printf("SANDBOX: SUCCESS with extension class: '%s'\n", ext_class ? ext_class : "NULL");
             fflush(stdout);
             break;
         }
         token = NULL;
+        
+        if (extension_classes[i] == NULL) break;  // Exit after NULL attempt
     }
     
-    printf("SANDBOX: sandbox_extension_issue_file returned: %d, token: %p\n", result, token);
+    printf("SANDBOX DEBUG: Loop complete, result=%d, token=%p\n", result, token);
     fflush(stdout);
     
     if (result != 0 || !token) {
diff --git a/lara/views/FileManagerView.swift b/lara/views/FileManagerView.swift
@@ -294,7 +294,46 @@ class FileUtilsBridge: NSObject {
         
         globallogger.log("[Bridge] listDirectory attempting to enumerate: \(path)")
         
-        // With sandbox tokens enabled at init, FileManager should now have access
+        // First try kernel VFS which has unrestricted access
+        globallogger.log("[Bridge] Attempting VFS approach for: \(path)")
+        if let vfsItems = FileUtils.listDirectoryVFS(path) {
+            globallogger.log("[Bridge] VFS succeeded with \(vfsItems.count) entries")
+            for name in vfsItems {
+                let fullPath = (path as NSString).appendingPathComponent(name)
+                
+                guard let attrs = try? FileManager.default.attributesOfItem(atPath: fullPath) else {
+                    globallogger.log("[Bridge] Could not get attrs for: \(name)")
+                    // Still add it even without attrs
+                    let item = FileItem(
+                        name: name,
+                        path: fullPath,
+                        isDirectory: false,
+                        size: 0,
+                        modifiedDate: Date()
+                    )
+                    items.append(item)
+                    continue
+                }
+                
+                let isDir = attrs[.type] as? String == FileAttributeType.typeDirectory.rawValue
+                let size = (attrs[.size] as? NSNumber)?.uint64Value ?? 0
+                let modDate = (attrs[.modificationDate] as? Date) ?? Date()
+                
+                let item = FileItem(
+                    name: name,
+                    path: fullPath,
+                    isDirectory: isDir,
+                    size: size,
+                    modifiedDate: modDate
+                )
+                items.append(item)
+            }
+            globallogger.log("[Bridge] Created \(items.count) FileItem objects from VFS")
+            return items
+        }
+        
+        // Fall back to FileManager if VFS fails
+        globallogger.log("[Bridge] VFS failed, falling back to FileManager for: \(path)")
         guard let enumerator = try? FileManager.default.contentsOfDirectory(
             atPath: path
         ) else {
