mach_absolute_time puzzling code

[moshe]

Hi,

I’ve encountered a puzzling code (and behavior) in iOS’s mach_absolute_time. I’m looking at 32 bit. It starts from reading a byte from 0xffff4088+0x8. These addresses should be kernel addresses, no? mach_vm_region on this address fails. In your book you mention commpage, but at another address.
When I try to read it via lldb – it fails as well. I can read the same byte with the injected code though.

Do you know:
- What is there?
- How big is this region and where it starts?

P.S. I ran a quick disassembly of all functions in the same dylib and only this one starts with reading from this address

[morpheus]

That address is very likely the commpage after all. If you look at jlaunchctl source, this is a hard coded "magic" which changes in 32 or 64. You can see that in OS X's launchctl hostinfo (which displays "last known mach absolute time". Read the bytes (all 8 of them) several times - if they change, it's the right value.